diff --git a/src/Models/QueueJobModel.php b/src/Models/QueueJobModel.php index a61e5ee..e91f2c4 100644 --- a/src/Models/QueueJobModel.php +++ b/src/Models/QueueJobModel.php @@ -131,15 +131,19 @@ private function skipLocked(string $sql): string */ private function setPriority(BaseBuilder $builder, array $priority): BaseBuilder { + $priority = array_values($priority); + $builder->whereIn('priority', $priority); if ($priority !== ['default']) { + $escapedPriority = array_map($this->db->escape(...), $priority); + if ($this->db->DBDriver !== 'MySQLi') { $builder->orderBy( sprintf('CASE %s ', $this->db->protectIdentifiers('priority')) . implode( ' ', - array_map(static fn ($value, $key) => "WHEN '{$value}' THEN {$key}", $priority, array_keys($priority)), + array_map(static fn ($value, $key) => "WHEN {$value} THEN {$key}", $escapedPriority, array_keys($escapedPriority)), ) . ' END', '', @@ -148,10 +152,7 @@ private function setPriority(BaseBuilder $builder, array $priority): BaseBuilder } else { $builder->orderBy( 'FIELD(priority, ' - . implode( - ',', - array_map(static fn ($value) => "'{$value}'", $priority), - ) + . implode(',', $escapedPriority) . ')', '', false, diff --git a/tests/Models/QueueJobModelTest.php b/tests/Models/QueueJobModelTest.php index 4d61f7e..8dfa58e 100644 --- a/tests/Models/QueueJobModelTest.php +++ b/tests/Models/QueueJobModelTest.php @@ -59,4 +59,22 @@ public function testSkipLockedFalse(): void $this->assertSame($sql, $result); } + + public function testSetPriorityEscapesPriorityValues(): void + { + $model = model(QueueJobModel::class); + $method = $this->getPrivateMethodInvoker($model, 'setPriority'); + $builder = $model->builder(); + + $priority = [ + 'priority_key' => "default' THEN 0 ELSE 1 END --", + 'default', + ]; + + $result = $method($builder, $priority); + $sql = $result->getCompiledSelect(); + + $this->assertStringContainsString($model->db->escape($priority['priority_key']), (string) $sql); + $this->assertStringNotContainsString('priority_key', (string) $sql); + } }