Firewall Blocking Requests with searchParams: Security Concerns and Best Practices

[samo-9]

Hi,

I recently encountered an issue where a request to the EspoCRM API using searchParams was blocked by the firewall. This has raised concerns about the security implications of using searchParams.

What are the potential risks associated with searchParams, such as SQL injection, improper input validation, or data exposure? How does EspoCRM handle these risks through its ORM framework or other built-in security measures to ensure the safety of queries? Furthermore, what best practices should developers follow to prevent such requests from being flagged or exposing vulnerabilities?

Any advice or guidance would be greatly appreciated!

Best,

[yuri]

Hi,

Database queries are generated by a separate layer (the query composer in ORM). We don't use any raw query in all our codebase including extensions. There were no SQL injection reports since the beginning (unlike some other systems built in 2000s where SQL injections were discovered every month).

[yuri]

> Furthermore, what best practices should developers follow to prevent such requests from being flagged or exposing vulnerabilities?

I believe it was flagged because of a GET parameter called 'select'.

[yuri]

Related: https://github.com/espocrm/espocrm/issues/2083