fix: prevent multipart content-type backtracking (#17679)

Updates multipart `Content-Type` validation so parameter separators
cannot also be consumed as parameter content. This allows malformed
values to be rejected promptly while preserving the multipart subtype
and parameter formats Payload already supports.

---------

Co-authored-by: Patrik Kozak <35232443+PatrikKozak@users.noreply.github.com>

Author: JarrodMFlesch

examples/auth/src/app/(app)/create-account/CreateAccountForm/index.tsx

@@ -2,6 +2,7 @@
 
 import Link from 'next/link'
 import { useRouter, useSearchParams } from 'next/navigation'
+import { getSafeRedirect } from 'payload/shared'
 import React, { useCallback, useRef, useState } from 'react'
 import { useForm } from 'react-hook-form'
 
@@ -51,7 +52,10 @@ export const CreateAccountForm: React.FC = () => {
         return
       }
 
-      const redirect = searchParams.get('redirect')
+      const redirect = getSafeRedirect({
+        fallbackTo: `/account?success=${encodeURIComponent('Account created successfully')}`,
+        redirectTo: searchParams.get('redirect') ?? '',
+      })
 
       const timer = setTimeout(() => {
         setLoading(true)
@@ -60,8 +64,7 @@ export const CreateAccountForm: React.FC = () => {
       try {
         await login(data)
         clearTimeout(timer)
-        if (redirect) {router.push(redirect)}
-        else {router.push(`/account?success=${encodeURIComponent('Account created successfully')}`)}
+        router.push(redirect)
       } catch (_) {
         clearTimeout(timer)
         setError('There was an error with the credentials provided. Please try again.')

examples/auth/src/app/(app)/login/LoginForm/index.tsx

@@ -2,6 +2,7 @@
 
 import Link from 'next/link'
 import { useRouter, useSearchParams } from 'next/navigation'
+import { getSafeRedirect } from 'payload/shared'
 import React, { useCallback, useRef } from 'react'
 import { useForm } from 'react-hook-form'
 
@@ -19,7 +20,12 @@ type FormData = {
 export const LoginForm: React.FC = () => {
   const searchParams = useSearchParams()
   const allParams = searchParams.toString() ? `?${searchParams.toString()}` : ''
-  const redirect = useRef(searchParams.get('redirect'))
+  const redirect = useRef(
+    getSafeRedirect({
+      fallbackTo: '/account',
+      redirectTo: searchParams.get('redirect') ?? '',
+    }),
+  )
   const { login } = useAuth()
   const router = useRouter()
   const [error, setError] = React.useState<null | string>(null)
@@ -39,8 +45,7 @@ export const LoginForm: React.FC = () => {
     async (data: FormData) => {
       try {
         await login(data)
-        if (redirect?.current) {router.push(redirect.current)}
-        else {router.push('/account')}
+        router.push(redirect.current)
       } catch (_) {
         setError('There was an error with the credentials provided. Please try again.')
       }

packages/payload/src/collections/operations/find.ts

@@ -18,6 +18,7 @@ import type {
 import { executeAccess } from '../../auth/executeAccess.js'
 import { combineQueries } from '../../database/combineQueries.js'
 import { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'
+import { validateSortQuery } from '../../database/queryValidation/validateSortQuery.js'
 import { sanitizeJoinQuery } from '../../database/sanitizeJoinQuery.js'
 import { sanitizeWhereQuery } from '../../database/sanitizeWhereQuery.js'
 import { afterRead } from '../../fields/hooks/afterRead/index.js'
@@ -158,7 +159,14 @@ export const findOperation = async <
 
     const sort = sanitizeSortQuery({
       fields: collection.config.flattenedFields,
-      sort: incomingSort,
+      sort: incomingSort || collectionConfig.defaultSort,
+    })
+
+    await validateSortQuery({
+      collectionConfig,
+      overrideAccess: overrideAccess!,
+      req,
+      sort,
     })
 
     const sanitizedJoins = await sanitizeJoinQuery({

packages/payload/src/collections/operations/findDistinct.ts

@@ -9,6 +9,7 @@ import type { Collection } from '../config/types.js'
 import { executeAccess } from '../../auth/executeAccess.js'
 import { combineQueries } from '../../database/combineQueries.js'
 import { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'
+import { validateSortQuery } from '../../database/queryValidation/validateSortQuery.js'
 import { sanitizeWhereQuery } from '../../database/sanitizeWhereQuery.js'
 import { APIError } from '../../errors/APIError.js'
 import { Forbidden } from '../../errors/Forbidden.js'
@@ -137,6 +138,13 @@ export const findDistinctOperation = async (
       }
     }
 
+    await validateSortQuery({
+      collectionConfig,
+      overrideAccess: overrideAccess!,
+      req,
+      sort: args.sort,
+    })
+
     if ('virtual' in fieldResult.field && fieldResult.field.virtual) {
       if (typeof fieldResult.field.virtual !== 'string') {
         throw new APIError(

packages/payload/src/collections/operations/findVersions.ts

@@ -8,6 +8,7 @@ import type { FindOptions } from './local/find.js'
 import { executeAccess } from '../../auth/executeAccess.js'
 import { combineQueries } from '../../database/combineQueries.js'
 import { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'
+import { validateSortQuery } from '../../database/queryValidation/validateSortQuery.js'
 import { sanitizeWhereQuery } from '../../database/sanitizeWhereQuery.js'
 import { afterRead } from '../../fields/hooks/afterRead/index.js'
 import { appendNonTrashedFilter } from '../../utilities/appendNonTrashedFilter.js'
@@ -87,6 +88,14 @@ export const findVersionsOperation = async <TData extends TypeWithVersion<TData>
       where: where!,
     })
 
+    await validateSortQuery({
+      collectionConfig,
+      overrideAccess: overrideAccess!,
+      req,
+      sort,
+      versionFields,
+    })
+
     let fullWhere = combineQueries(where!, accessResults)
 
     // Exclude trashed documents when trash: false

packages/payload/src/collections/operations/update.ts

@@ -15,6 +15,7 @@ import type {
 import { executeAccess } from '../../auth/executeAccess.js'
 import { combineQueries } from '../../database/combineQueries.js'
 import { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'
+import { validateSortQuery } from '../../database/queryValidation/validateSortQuery.js'
 import { sanitizeWhereQuery } from '../../database/sanitizeWhereQuery.js'
 import { APIError } from '../../errors/index.js'
 import { type CollectionSlug, type FindOptions } from '../../index.js'
@@ -175,7 +176,14 @@ export const updateOperation = async <
 
     const sort = sanitizeSortQuery({
       fields: collection.config.flattenedFields,
-      sort: incomingSort,
+      sort: incomingSort || collectionConfig.defaultSort,
+    })
+
+    await validateSortQuery({
+      collectionConfig,
+      overrideAccess: overrideAccess!,
+      req,
+      sort,
     })
 
     let docs

packages/payload/src/database/queryValidation/validateQueryPaths.ts

@@ -50,7 +50,7 @@ export async function validateQueryPaths({
     for (const path in where) {
       const constraint = where[path]
 
-      if ((path === 'and' || path === 'or') && Array.isArray(constraint)) {
+      if (['and', 'or'].includes(path.toLowerCase()) && Array.isArray(constraint)) {
         for (const item of constraint) {
           if (collectionConfig) {
             promises.push(
@@ -80,6 +80,8 @@ export async function validateQueryPaths({
             )
           }
         }
+      } else if (Array.isArray(constraint)) {
+        errors.push({ path })
       } else if (!Array.isArray(constraint)) {
         for (const operator in constraint) {
           const val = constraint[operator as keyof typeof constraint]

packages/payload/src/database/queryValidation/validateSortQuery.ts

@@ -0,0 +1,83 @@
+import type { SanitizedCollectionConfig } from '../../collections/config/types.js'
+import type { FlattenedField } from '../../fields/config/types.js'
+import type { SanitizedGlobalConfig } from '../../globals/config/types.js'
+import type { PayloadRequest, Sort, Where } from '../../types/index.js'
+
+import { getLocalizedPaths } from '../getLocalizedPaths.js'
+import { validateQueryPaths } from './validateQueryPaths.js'
+
+type Args = {
+  overrideAccess: boolean
+  req: PayloadRequest
+  sort?: Sort
+  versionFields?: FlattenedField[]
+} & (
+  | {
+      collectionConfig: SanitizedCollectionConfig
+      globalConfig?: undefined
+    }
+  | {
+      collectionConfig?: undefined
+      globalConfig: SanitizedGlobalConfig
+    }
+)
+
+/**
+ * Ensures sort paths are subject to the same field-read access checks as query `where` paths,
+ * since database sorting happens before response-time field redaction.
+ */
+export const validateSortQuery = async ({
+  collectionConfig,
+  globalConfig,
+  overrideAccess,
+  req,
+  sort,
+  versionFields,
+}: Args): Promise<void> => {
+  if (overrideAccess || !sort) {
+    return
+  }
+
+  const fields = versionFields || (globalConfig || collectionConfig).flattenedFields
+  const sortFields = Array.isArray(sort) ? sort : [sort]
+  const where: Where = {}
+
+  for (const sortField of sortFields) {
+    const path = sortField.replace(/^-/, '').replace(/__/g, '.')
+    const paths = getLocalizedPaths({
+      collectionSlug: collectionConfig?.slug,
+      fields,
+      globalSlug: globalConfig?.slug,
+      incomingPath: path,
+      locale: req.locale!,
+      overrideAccess: true,
+      payload: req.payload,
+    })
+
+    if (path !== 'id' && path !== '_id' && paths.every(({ invalid }) => !invalid)) {
+      where[path] = { exists: true }
+    }
+  }
+
+  if (Object.keys(where).length === 0) {
+    return
+  }
+
+  if (collectionConfig) {
+    await validateQueryPaths({
+      collectionConfig,
+      overrideAccess,
+      req,
+      versionFields,
+      where,
+    })
+  } else {
+    await validateQueryPaths({
+      globalConfig,
+      overrideAccess,
+      req,
+      versionFields,
+      where,
+    })
+  }
+}

packages/payload/src/database/sanitizeJoinQuery.ts

@@ -5,6 +5,7 @@ import { executeAccess } from '../auth/executeAccess.js'
 import { QueryError } from '../errors/QueryError.js'
 import { combineQueries } from './combineQueries.js'
 import { validateQueryPaths } from './queryValidation/validateQueryPaths.js'
+import { validateSortQuery } from './queryValidation/validateSortQuery.js'
 import { sanitizeWhereQuery } from './sanitizeWhereQuery.js'
 
 type Args = {
@@ -74,6 +75,12 @@ const sanitizeJoinFieldQuery = async ({
       // incoming where input, but we shouldn't validate generated from the access control.
       where: joinQuery.where,
     }),
+    validateSortQuery({
+      collectionConfig: joinCollectionConfig,
+      overrideAccess,
+      req,
+      sort: joinQuery.sort || join.field.defaultSort || joinCollectionConfig.defaultSort,
+    }),
   )
 
   if (typeof accessResult === 'object') {

packages/payload/src/globals/operations/findVersions.ts

@@ -7,6 +7,7 @@ import type { SanitizedGlobalConfig } from '../config/types.js'
 import { executeAccess } from '../../auth/executeAccess.js'
 import { combineQueries } from '../../database/combineQueries.js'
 import { validateQueryPaths } from '../../database/queryValidation/validateQueryPaths.js'
+import { validateSortQuery } from '../../database/queryValidation/validateSortQuery.js'
 import { afterRead } from '../../fields/hooks/afterRead/index.js'
 import { killTransaction } from '../../utilities/killTransaction.js'
 import { sanitizeInternalFields } from '../../utilities/sanitizeInternalFields.js'
@@ -66,6 +67,14 @@ export const findVersionsOperation = async <T extends TypeWithVersion<T>>(
       where: where!,
     })
 
+    await validateSortQuery({
+      globalConfig,
+      overrideAccess: overrideAccess!,
+      req,
+      sort,
+      versionFields,
+    })
+
     const fullWhere = combineQueries(where!, accessResults)
 
     const select = sanitizeSelect({