[WEB-8110] fix: sanitize page list order_by against an allowlist (GHSA-2v48) by mguptahub · Pull Request #9387 · makeplane/plane

mguptahub · 2026-07-10T04:07:04Z

Fixes the app project-pages residual of GHSA-2v48-qcjw-74ch (HIGH).

Problem

PageViewSet.get_queryset passed the raw order_by query param straight into .order_by(self.request.GET.get("order_by", "-created_at")). In Django 4.2, .order_by(<field>) resolves field names at call time, so:

an unknown field (order_by=password) raises FieldError → 500 DoS;
a valid relation path (order_by=owned_by__password) performs ORM relational traversal.

Verified empirically against origin/preview (500 on password/bogus__field; 200 traversal on owned_by__password).

Fix

Add PAGE_ORDER_BY_ALLOWLIST to utils/order_queryset.py and wrap the param with the existing sanitize_order_by() before it reaches .order_by() — the same pattern already used by the issue/project/view/notification endpoints. Unknown or malformed values fall back to the safe -created_at default.

Scope

This covers only the app project-pages residual. The 3 external-REST-API sites in the advisory are handled by #9348. EE Wiki counterpart: WEB-8111 (plane-ee). EE project pages are already protected via _safe_order_by.

Tests

tests/contract/app/test_page_order_by_allowlist_app.py — 10 tests (invalid field / relation-path rejected → 200, allowlisted accepted, default). Fail-before verified (invalid fields return 500 before the fix). ruff + manage.py check green.

Summary by CodeRabbit

Bug Fixes
- Improved page list sorting to validate and sanitize the order_by parameter against an allowlist.
- Prevented unsafe sorting inputs from causing errors or attempting disallowed field traversal.
- Preserved approved sorting options (including ascending/descending variants) and applied a safe default when omitted.
- Ensured consistent ordering with pinned favorites and a stable pagination tie-break.

…A-2v48) PageViewSet.get_queryset passed the raw order_by query param into .order_by(). In Django 4.2 .order_by() resolves field names at call time, so an unknown field (e.g. order_by=password) raises FieldError → 500 DoS, and a valid relation path (e.g. order_by=owned_by__password) enables ORM relational traversal (GHSA-2v48-qcjw-74ch). Add PAGE_ORDER_BY_ALLOWLIST to utils/order_queryset.py and wrap the param with the existing sanitize_order_by() before it reaches .order_by(), matching the issue/project/view/notification endpoints. Unknown or malformed values fall back to the safe -created_at default. Covers only the app project-pages residual; the 3 external-REST-API sites in the advisory are handled by PR #9348. EE Wiki counterpart: WEB-8111. Add contract regression tests (fail-before verified). Co-authored-by: Plane AI <noreply@plane.so>

makeplane · 2026-07-10T04:07:20Z

Linked to Plane Work Item(s)

(WEB-8110) [Security] GHSA-2v48 — Page order_by ORM injection (CE project pages)

References

(WEB-8111) [Security] GHSA-2v48 — Page order_by ORM injection (EE Wiki/workspace pages)

This comment was auto-generated by Plane

coderabbitai · 2026-07-10T04:07:24Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 62741268-e4e0-4c31-a445-34397c65bf88

📥 Commits

Reviewing files that changed from the base of the PR and between 96b69d0 and 0c8e115.

📒 Files selected for processing (2)

apps/api/plane/app/views/page/base.py
apps/api/plane/tests/contract/app/test_page_order_by_allowlist_app.py

🚧 Files skipped from review as they are similar to previous changes (2)

apps/api/plane/tests/contract/app/test_page_order_by_allowlist_app.py
apps/api/plane/app/views/page/base.py

📝 Walkthrough

Walkthrough

Page list ordering now uses an explicit allowlist and sanitization before applying query parameters. Contract tests cover malicious, allowlisted, descending, omitted, and effective order_by values.

Changes

Page order_by hardening

Layer / File(s)	Summary
Ordering contract and queryset wiring `apps/api/plane/utils/order_queryset.py`, `apps/api/plane/app/views/page/base.py`	Defines allowed page ordering fields and sanitizes `order_by` before applying it to the page queryset, while preserving favorite priority and adding stable ID tie-breaking.
Ordering regression coverage `apps/api/plane/tests/contract/app/test_page_order_by_allowlist_app.py`	Adds fixtures and contract tests for unsafe values, allowlisted ascending and descending values, omitted parameters, and actual name-based response ordering.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

[[WEB-7813] fix: prevent ORM order_by injection in issue and other endpoints #9292](https://github.com/ [WEB-7813] fix: prevent ORM order_by injection in issue and other endpoints #9292): Applies the same order_by sanitization pattern with endpoint-specific allowlists.

Suggested reviewers: pablohashescobar, Saurabhkmr98, dheeru0198

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 14.29% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely matches the main change: sanitizing page list order_by against an allowlist.
Description check	✅ Passed	The description covers the problem, fix, scope, and tests, but it doesn't use every template section such as Type of Change or References.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch web-8110/page-order-by-allowlist

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Copilot

Pull request overview

This PR addresses a security hardening gap in the app “project pages” list endpoint by adding an allowlisted sanitizer for the order_by query parameter before it reaches Django ORM .order_by(), preventing invalid-field FieldError (500) and relational-path traversal attempts.

Changes:

Introduces PAGE_ORDER_BY_ALLOWLIST alongside existing order-by allowlists in utils/order_queryset.py.
Applies sanitize_order_by() to the order_by query param in PageViewSet.get_queryset.
Adds contract regression tests covering malicious and allowlisted order_by values for the pages endpoint.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
apps/api/plane/utils/order_queryset.py	Adds `PAGE_ORDER_BY_ALLOWLIST` to support safe page list ordering sanitization.
apps/api/plane/app/views/page/base.py	Sanitizes the incoming `order_by` param before passing it to Django `.order_by()`.
apps/api/plane/tests/contract/app/test_page_order_by_allowlist_app.py	Adds contract regression coverage for injected and allowlisted `order_by` inputs.

coderabbitai

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/api/plane/app/views/page/base.py`:
- Around line 104-115: Merge the queryset’s duplicate .order_by() calls into one
call, preserving "-is_favorite" as the primary sort and using
sanitize_order_by(self.request.GET.get("order_by", "-created_at"),
PAGE_ORDER_BY_ALLOWLIST, default="-created_at") as the user-controlled fallback;
remove the later overriding .order_by("-is_favorite", "-created_at") call.

In `@apps/api/plane/tests/contract/app/test_page_order_by_allowlist_app.py`:
- Around line 35-69: Add direct unit coverage for sanitize_order_by using
PAGE_ORDER_BY_ALLOWLIST, including valid ascending/descending fields, unknown
and relation paths, double-dash, empty/None, and whitespace inputs with expected
default fallback. Strengthen TestPageOrderByAllowlist integration coverage by
using a fixture that creates multiple distinctly named pages and asserting
response ordering for ascending and descending order_by values, rather than
checking only status_code.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5b5bf425-96c5-4b16-bb63-561bfb68618e

📥 Commits

Reviewing files that changed from the base of the PR and between dc9d80b and 96b69d0.

📒 Files selected for processing (3)

apps/api/plane/app/views/page/base.py
apps/api/plane/tests/contract/app/test_page_order_by_allowlist_app.py
apps/api/plane/utils/order_queryset.py

… (review) Address CodeRabbit + Copilot on #9387: the sanitized .order_by(user) was immediately overridden by a later .order_by("-is_favorite", "-created_at"), so the order_by param had no effect on the result (dead code) and cost an extra query-build step. Merge them into one .order_by("-is_favorite", <sanitized>, "id") — matching the EE project-pages viewset — so favourites stay pinned first, the allowlisted user ordering actually applies as the secondary sort, and id is a stable pagination tiebreak. The no-param default is unchanged (-created_at). Add a test asserting order_by=name / -name actually reorders the results. Co-authored-by: Plane AI <noreply@plane.so>

mguptahub requested a review from dheeru0198 as a code owner July 10, 2026 04:07

Copilot AI review requested due to automatic review settings July 10, 2026 04:07

mguptahub requested a review from pablohashescobar as a code owner July 10, 2026 04:07

Copilot started reviewing on behalf of mguptahub July 10, 2026 04:07 View session

Copilot AI reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/api/plane/app/views/page/base.py Outdated

Comment thread apps/api/plane/tests/contract/app/test_page_order_by_allowlist_app.py

coderabbitai Bot reviewed Jul 10, 2026

View reviewed changes

Comment thread apps/api/plane/app/views/page/base.py Outdated

Comment thread apps/api/plane/tests/contract/app/test_page_order_by_allowlist_app.py

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[WEB-8110] fix: sanitize page list order_by against an allowlist (GHSA-2v48)#9387

[WEB-8110] fix: sanitize page list order_by against an allowlist (GHSA-2v48)#9387
mguptahub wants to merge 2 commits into
previewfrom
web-8110/page-order-by-allowlist

mguptahub commented Jul 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

makeplane Bot commented Jul 10, 2026

Uh oh!

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mguptahub commented Jul 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem

Fix

Scope

Tests

Summary by CodeRabbit

Uh oh!

makeplane Bot commented Jul 10, 2026

Uh oh!

coderabbitai Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

mguptahub commented Jul 10, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 10, 2026 •

edited

Loading