[mcop1]

Backport of #1185 to the 2.4 line (platform version 2025.4, LTS until December 2028).

Vulnerability

Pimcore\Bundle\DataHubBundle\GraphQL\Helper::buildSqlCondition() returned any string it received unchanged. The filter argument of getAssetListing and of the data object listings is JSON-decoded and passed to this builder, so a JSON string at the top level or nested inside $and / $or / a field array ended up in the listing's WHERE clause as raw SQL.

Fix

Same change as #1185: buildSqlCondition() only accepts JSON objects and arrays of objects, at every level, and rejects anything else with a ClientSafeException ("invalid filter: conditions must be JSON objects"); addJoins() skips non-object entries.

Differences to the 1.9 commit:

• tests/GraphQL/HelperTest.php carries this line's POCL license header.
• The upgrade note is placed in 2.4.7 (only conflict of the cherry-pick).

Backward compatibility

Helper is @internal. Every filter in the documented syntax produces the same SQL as before; only undocumented raw-string filters are rejected now.

Release notes

The filter argument of getAssetListing and the data object listing queries only accepts the documented JSON syntax: an object, or an array of objects, at every level (including inside $and / $or and field arrays). Any other value, such as a plain JSON string, is rejected with the error invalid filter: conditions must be JSON objects instead of being added to the listing condition. Filters written in the documented syntax are not affected.

Testing

Verified locally against this line's dependencies (pimcore/pimcore container + MariaDB 10.11): full Codeception suite green, including the new HelperTest (11/11) and AssetListingTest cases; PHPStan (project config) and php-cs-fixer clean.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🟢 Approval recommended

No active review issues block the GraphQL filter-validation backport.

No open issues 🎉

What changed in this PR

Backports the GraphQL listing filter SQL injection fix to the 2.4 line. The change rejects raw SQL strings in filter conditions while preserving documented JSON filter syntax.

Changes:

• Validates condition types recursively and skips non-object entries during join processing.
• Adds regression tests for valid filters and rejection of non-object conditions.
• Documents the filter restrictions in the 2.4.7 upgrade notes.

File	Description
tests/​GraphQL/​Resolver/​AssetListingTest.php	Tests valid asset filtering and rejection of raw-string filters.
tests/​GraphQL/​HelperTest.php	Adds SQL generation, invalid-condition, and join-processing tests.
src/​GraphQL/​Helper.php	Rejects invalid condition types and guards join processing.
doc/​01_Installation_and_Upgrade/​01_Upgrade_Notes.md	Explains the filter restrictions and client-facing error.

_{Review effort: Balanced}

[mcop1]

Superseded by forward merge 1.9 → 2.4 → 2026.3 → 2026.x of #1185.