fix(security): consolidated hardening — SQL injection, XSS, unserialize, trigger_cmd

[somethingwithproof]

What

Consolidates security hardening from PRs #766, #767, #769, #770, #771, #772 into a single reviewable diff.

SQL injection — bulk form actions (notify_lists.php)

• Replaced array_to_sql_or() and direct $selected_items[$i] string concatenation with db_execute_prepared() and IN (?,?,?) placeholders built via implode(',', array_fill(0, cacti_sizeof($selected_items), '?')).
• drp_action allowlist check used array_keys() (returns ints) with in_array(..., true) (strict); added array_map('strval', ...) to align types.
• All four bulk action blocks are wrapped in db_begin_transaction() / db_commit_transaction(). Every db_execute_prepared() return is tracked in $ok; false calls db_rollback_transaction() and breaks per-item loops immediately.
• The flat delete block chains all eight statements with && so the first failure short-circuits the rest rather than running all statements before rollback.
• thold_template_update_thresholds() moved after commit so the cascade does not participate in the transaction boundary.
• Original code had SET thold_host_email = 0 AND deleted="" (MySQL parsed AND deleted="" as part of the SET expression, a bug). Corrected: deleted = "" moved to WHERE clause.

SQL injection — graph filter (thold_functions.php)

• get_allowed_thresholds() and get_allowed_threshold_logs(): $graph_id was interpolated directly into the WHERE clause. Changed to gl.id = ? placeholder with $sql_params[] accumulator. Both db_fetch_assoc_prepared() and db_fetch_cell_prepared() now receive bound params.

RLIKE injection (notify_lists.php, thold.php, thold_graph.php)

• rfilter validated via FILTER_VALIDATE_IS_REGEX before reaching any SQL. db_qstr() escapes the already-validated value for use in RLIKE clauses.

XSS — hidden inputs and AJAX URL params

• get_request_var('page') in thold.php and thold_graph.php hidden inputs wrapped with html_escape().
• AJAX filter URL parameters wrapped with encodeURIComponent() across thold.php, thold_graph.php, notify_lists.php, thold_templates.php, thold_webapi.php.

Object injection (thold_webapi.php)

• sanitize_unserialize_selected_items() applied to selected_graphs_array; raw unserialize() call removed.

PHP 7.4 compatibility (setup.php)

• count($selected_items) changed to cacti_sizeof($selected_items).

Why

All six original PRs addressed overlapping sets of vulnerabilities without complete test coverage or atomic transaction boundaries. Pre-authentication SQL injection via bulk form actions was the highest-severity issue: array_to_sql_or() constructed WHERE clauses from unsanitized POST data. The RLIKE injection via rfilter and the XSS via the page parameter were secondary. Atomicity was missing entirely — partial deletes across 8 tables could leave orphaned host references.

Test plan

• vendor/bin/pest tests/ — 53 tests, all passing
• PreparedStatementTest.php — prepared-statement usage, transaction count, rollback presence, $ok tracking, loop break guards, template cascade position
• RlikeInjectionTest.php — FILTER_VALIDATE_IS_REGEX presence, db_qstr() usage, no raw $rfilter interpolation
• XssEscapingTest.php — html_escape() on page inputs, encodeURIComponent() in AJAX filters
• UnserializeHardeningTest.php — sanitize_unserialize_selected_items() applied, object injection blocked
• Php74CompatibilityTest.php — no PHP 8.0+ syntax across 9 plugin files
• PreparedStatementConsistencyTest.php — no single-line interpolated raw db_*() calls in hardened files
• PhpSyntaxTest.php (smoke) — all plugin PHP files lint clean

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR hardens the Thold plugin against multiple security issues (SQL injection via RLIKE concatenation and bulk-action concatenation, XSS via unescaped request vars in URLs and HTML, and unsafe deserialization) and corrects a couple of variable-name bugs in thold_command_execution(). It also introduces a Pest-based test suite with stubs/bootstrap for running outside Cacti, plus PHP lint and PHP 7.4 compatibility smoke tests.

Changes:

• Replace raw RLIKE/SQL string concatenation with db_qstr() and parameterized queries (db_execute_prepared, db_fetch_assoc_prepared, db_fetch_cell_prepared), and add $sql_params to get_allowed_thresholds/get_allowed_threshold_logs.
• Wrap URL parameters in encodeURIComponent, escape get_request_var('page') with html_escape in hidden inputs, replace cacti_unserialize(stripslashes(...)) with sanitize_unserialize_selected_items, and add drp_action whitelist + per-branch input validation in notify_lists.php.
• Fix two thold_set_environ calls that incorrectly passed trigger_cmd_high in the low/norm branches; add Pest test suite, bootstrap stubs, composer.json, and phpunit.xml.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
notify_lists.php	Convert bulk SQL to prepared statements; add drp_action whitelist and request var filters; encode URL params
thold_functions.php	Add $sql_params, switch to prepared SELECTs; fix trigger_cmd_low/norm environ args; annotate eval/exec with nosemgrep
thold_graph.php	Use db_qstr for RLIKE; html_escape page var; encodeURIComponent URL params
thold.php	Use db_qstr for RLIKE; encodeURIComponent URL params
thold_templates.php	encodeURIComponent on filter
thold_webapi.php	Switch to sanitize_unserialize_selected_items; encode URL params
notify_queue.php	encodeURIComponent URL params
setup.php	Use cacti_sizeof instead of count
tests/*	New Pest test suite, bootstrap stubs, smoke/security tests
composer.json, phpunit.xml	Test tooling config

Comments suppressed due to low confidence (1)

notify_lists.php:21

• $actions and $assoc_actions are not visible in this diff hunk, but the existing code branches further below dispatch on drp_action == '1' / '2' for at least three different contexts (lists, associate, templates, tholds) which may use overlapping numeric keys. Combining them with $actions + $assoc_actions only validates membership in the union of keys, which is fine, but please confirm that all four save_* sections (save_list, save_associate, save_templates, save_tholds) only ever receive drp_action values present in one of those two arrays — otherwise legitimate actions will hit raise_message(40) and redirect. If save_templates/save_tholds use a different action map, they will be rejected here.

 | http://www.cacti.net/                                                   |

[somethingwithproof]

@TheWitness @netniV — requesting a final review on this consolidated security hardening PR when you have a moment.

Latest push (3405133) hardens the two remaining items in thold_functions.php:

1. RPN evaluator — removed both eval() sinks in thold_expression_math_rpn(). Replaced with native switch dispatch:

   • Binary operators (+ - * / % ^): direct computation; + 0 coercion and (int) casts preserve the integer semantics eval() applied to % and ^.
   • Unary functions (SIN/COS/TAN/ATAN/SQRT/FLOOR/CEIL/DEG2RAD/RAD2DEG/ABS/EXP/LOG): dispatch to the native math functions, plus a newly added is_numeric() guard that was previously missing on this path. Operands were already validated numeric and operators/functions already whitelisted, so legitimate RPN behavior is unchanged.

2. trigger_cmd_* execution — shell escaping. thold_replace_threshold_tags() gained a $shell flag; only the three trigger_cmd_high/low/norm exec() callers pass true, which wraps device/user-derived string tags (<DESCRIPTION>, <HOSTNAME>, <LOCATION>, <SITE>, <THRESHOLDNAME>, <DSNAME>, <NOTES>, <DNOTES>, <DEVICENOTE>, <EXTERNALID>) in cacti_escapeshellarg(). Email/HTML callers keep the default $shell = false and are unaffected. Numeric/computed tags remain unescaped.

Validation: php -l clean, PHP 7.4-safe (no PHP 8-only syntax), targeting 1.2.31-idiomatic helpers.

Known follow-ups:

• The branch is currently conflicting with develop and needs a rebase — happy to rebase before merge.
• thold_expand_string()'s |...| substitutions into the command line remain unescaped (lower risk: admin-set graph titles / DS names); can address in a follow-up if you'd like it in scope.

[somethingwithproof]

Thanks for the automated review. Status of each point below — most were already handled in earlier commits on this branch; the two outstanding items are addressed in 0e2c54e.

Addressed in 0e2c54e:

• notify_lists.php — SQL string quoting consistency (the notify_warning_extra/notify_extra clearing queries): converted both from double-quoted PHP strings with escaped \"\" to single-quoted strings, matching the surrounding prepared queries in the same block. Verified the rendered SQL is byte-identical (SET … = '' … AND (tt.notify_templated = "" OR tt.notify_templated IS NULL)), so this is a pure readability change.
• thold_functions.php — exec() env side-effect: the putenv()/thold_set_environ() note now appears on all three trigger_cmd_high/low/norm branches (it previously existed only on the low branch).

Already handled earlier on this branch:

• thold_functions.php — $sql_params contract: get_allowed_thresholds() / get_allowed_threshold_logs() both carry a docblock noting $sql_where may contain ? placeholders supplied via $sql_params.
• tests/Smoke/PhpSyntaxTest.php — unquoted $phpBin: the lint command already wraps both $phpBin and $file in escapeshellarg().
• tests/Security/RlikeInjectionTest.php — readability: the asserted pre-fix patterns are expressed as nowdocs with an explanatory comment.
• tests/bootstrap.php — stub drift: the sanitize_unserialize_selected_items() stub carries a KEEP IN SYNC with Cacti core comment.
• deleted = "" behavioral change: documented in the PR description (“What” section) — the original SET thold_host_email = 0 AND deleted="" was a bug; deleted = "" is now correctly in the WHERE clause.

No change (with rationale):

• notify_lists.php — header('Location: …'); exit; idiom: this is the established Cacti 1.2.x pattern, used consistently in this same file (e.g. the other form_actions() redirects) and throughout core, so it was left as-is rather than switching to header_redirect().
• drp_action allowlist coverage (low-confidence note): confirmed all four save_* contexts (save_list, save_associate, save_templates, save_tholds) dispatch only on drp_action 1/2, so the $actions + $assoc_actions union ({1,2}) fully covers them. Type alignment via array_map('strval', …) is noted in the PR description.

php -l is clean on both changed files; changes remain PHP 7.4-safe. Note the branch is still CONFLICTING with develop (single-file conflict in thold_functions.php) — I'll rebase before merge.

[somethingwithproof]

@TheWitness @netniV — this is ready for a final review when you have a moment.

Status

• The automated review feedback is fully addressed as of 0e2c54e (per the itemized comment above): SQL quoting consistency in notify_lists.php, exec() env-side-effect comments across all three trigger_cmd_* branches, plus confirmation that the already-handled items (docblocks, test escaping, stub-sync note, the deleted = "" WHERE fix) are in place.

CI heads-up

• The Plugin Integration Tests workflow has not run on the latest commits — the current head (0e2c54e) has no check runs, and the most recent runs on this branch are from mid-May (on the older commits) and failed. On fork PRs this repo gates workflow runs on maintainer approval, so CI can't validate the current head until one of you approves the run. Could you approve/trigger it? I'll promptly fix anything it surfaces.

Before merge

• The branch is still conflicting with develop (a single-file conflict in thold_functions.php). I'll rebase once you've had an initial look, so the final review reflects the state you'd merge.

Thanks!

[somethingwithproof]

Update: merged latest develop (#774) — now mergeable, hardening verified

This PR is now mergeable against develop as of 592cc7e.

Conflict resolution with #774

develop #774 ("fix 13 logic bugs in RPN evaluation, SNMP traps, and notification handling") rewrote the same thold_expression_math_rpn() evaluator this PR hardens. I merged develop in and resolved thold_functions.php to keep both:

• fix(thold-functions): fix 13 logic bugs in RPN evaluation, SNMP traps, and notification handling #774's operand guards (is_numeric on $v1/$v2) and division-by-zero handling (auto-merged, unchanged), and
• this PR's eval() removal — both RPN sinks now use native switch dispatch.

Semantics are identical to the previous eval() (binary computes $v2 <op> $v1 with (int) casts on %/^; unary dispatches sin()/cos()/… — PHP function names are case-insensitive). The two queued exec() annotations were aligned to develop's wording (the call itself is unchanged).

Security changes recap

• RPN evaluator: eval() → native switch (removes the code-execution sink); added the missing is_numeric guard on the unary path.
• trigger_cmd_* exec: device/user-derived tags escaped via cacti_escapeshellarg() (new $shell flag on thold_replace_threshold_tags()); email/HTML callers unaffected.
• Earlier: prepared statements + db_qstr for RLIKE, encodeURIComponent on AJAX filters, sanitize_unserialize_selected_items, and transaction/atomicity fixes.

Validation

• Pest suite: 53 passed / 0 failed (Security + Smoke), incl. TriggerCmdRegressionTest, RlikeInjectionTest, UnserializeHardeningTest, XssEscapingTest, Php74CompatibilityTest, and php -l across all plugin files.
• No eval() sinks remain; PHP 7.4-safe.

Known follow-ups (not in this PR)

• thold_expand_string()'s |...| graph/DS-metadata substitutions into the command line remain unescaped (lower risk: admin-set values).
• fix(thold-functions): fix 13 logic bugs in RPN evaluation, SNMP traps, and notification handling #774's 0/0-division branch breaks out of the operator switch before pushing the result — identical on develop, so an upstream matter.

@TheWitness @netniV — this is ready for review whenever you have a moment; happy to adjust anything.