chore: harden database queue priority ordering

Co-authored-by: Bogdan Lambarski <matolq@gmail.com>

Author: michalsn

src/Models/QueueJobModel.php

@@ -131,15 +131,19 @@ private function skipLocked(string $sql): string
      */
     private function setPriority(BaseBuilder $builder, array $priority): BaseBuilder
     {
+        $priority = array_values($priority);
+
         $builder->whereIn('priority', $priority);
 
         if ($priority !== ['default']) {
+            $escapedPriority = array_map([$this->db, 'escape'], $priority);
+
             if ($this->db->DBDriver !== 'MySQLi') {
                 $builder->orderBy(
                     sprintf('CASE %s ', $this->db->protectIdentifiers('priority'))
                     . implode(
                         ' ',
-                        array_map(static fn ($value, $key) => "WHEN '{$value}' THEN {$key}", $priority, array_keys($priority)),
+                        array_map(static fn ($value, $key) => "WHEN {$value} THEN {$key}", $escapedPriority, array_keys($escapedPriority)),
                     )
                     . ' END',
                     '',
@@ -148,10 +152,7 @@ private function setPriority(BaseBuilder $builder, array $priority): BaseBuilder
             } else {
                 $builder->orderBy(
                     'FIELD(priority, '
-                    . implode(
-                        ',',
-                        array_map(static fn ($value) => "'{$value}'", $priority),
-                    )
+                    . implode(',', $escapedPriority)
                     . ')',
                     '',
                     false,

tests/Models/QueueJobModelTest.php

@@ -59,4 +59,22 @@ public function testSkipLockedFalse(): void
 
         $this->assertSame($sql, $result);
     }
+
+    public function testSetPriorityEscapesPriorityValues(): void
+    {
+        $model   = model(QueueJobModel::class);
+        $method  = $this->getPrivateMethodInvoker($model, 'setPriority');
+        $builder = $model->builder();
+
+        $priority = [
+            'priority_key' => "default' THEN 0 ELSE 1 END --",
+            'default',
+        ];
+
+        $result = $method($builder, $priority);
+        $sql    = $result->getCompiledSelect();
+
+        $this->assertStringContainsString($model->db->escape($priority['priority_key']), $sql);
+        $this->assertStringNotContainsString('priority_key', $sql);
+    }
 }