Unescaped query parameter in query-database.php

[CoachBirgit]

Description

The query-database ability passes a user-constructed $query variable directly into $wpdb->get_results() without preparation or escaping.

Affected lines

• Line 157: $wpdb->get_results() with unescaped $query (assigned at line 154)
• Same line: no caching around the query

Action needed

This ability accepts SQL from the AI, which is already a sensitive operation. At minimum:

1. Validate that the query is read-only (starts with SELECT, does not contain INSERT, UPDATE, DELETE, DROP, ALTER, TRUNCATE)
2. Use $wpdb->prepare() where possible
3. Add caching or document why it's skipped
4. Consider a query length limit and timeout

PHPCS rules

• WordPress.DB.DirectDatabaseQuery.DirectQuery (WARNING)
• WordPress.DB.DirectDatabaseQuery.NoCaching (WARNING)
• PluginCheck.Security.DirectDB.UnescapedDBParameter (WARNING)

[ivdimova]

All items from this issue were already resolved in PR #199 (commit 7d7321c), which landed before this issue was opened.

Verified in current includes/abilities/query-database.php:

• ✅ Read-only verb gate: SELECT, SHOW, DESCRIBE, EXPLAIN only
• ✅ Forbidden keyword blocklist: INSERT/UPDATE/DELETE/DROP/ALTER/TRUNCATE/CREATE/REPLACE/GRANT/REVOKE
• ✅ Sensitive column blocklist: user_pass, user_email, user_activation_key, session_tokens
• ✅ 2000-char query length cap
• ✅ phpcs:ignore with documented justification for why prepare() can't be used (LLM generates the full query — no separable placeholders)
• ✅ Caching intentionally skipped with reasoning (each LLM query is unique; a cache would never hit)
• ✅ Per-row redaction of sensitive columns as belt-and-suspenders defense

Closing as already resolved.