From dbe6b497cdabca6d0317bfa8190e76cf07eaefe1 Mon Sep 17 00:00:00 2001
From: michalsn <michal@sniatala.pl>
Date: Mon, 13 Jul 2026 19:17:41 +0200
Subject: [PATCH 1/2] chore: harden database queue priority ordering

Co-authored-by: Bogdan Lambarski <matolq@gmail.com>
---
 src/Models/QueueJobModel.php       | 11 ++++++-----
 tests/Models/QueueJobModelTest.php | 18 ++++++++++++++++++
 2 files changed, 24 insertions(+), 5 deletions(-)

diff --git a/src/Models/QueueJobModel.php b/src/Models/QueueJobModel.php
index a61e5ee..56dbbc4 100644
--- a/src/Models/QueueJobModel.php
+++ b/src/Models/QueueJobModel.php
@@ -131,15 +131,19 @@ private function skipLocked(string $sql): string
      */
     private function setPriority(BaseBuilder $builder, array $priority): BaseBuilder
     {
+        $priority = array_values($priority);
+
         $builder->whereIn('priority', $priority);
 
         if ($priority !== ['default']) {
+            $escapedPriority = array_map([$this->db, 'escape'], $priority);
+
             if ($this->db->DBDriver !== 'MySQLi') {
                 $builder->orderBy(
                     sprintf('CASE %s ', $this->db->protectIdentifiers('priority'))
                     . implode(
                         ' ',
-                        array_map(static fn ($value, $key) => "WHEN '{$value}' THEN {$key}", $priority, array_keys($priority)),
+                        array_map(static fn ($value, $key) => "WHEN {$value} THEN {$key}", $escapedPriority, array_keys($escapedPriority)),
                     )
                     . ' END',
                     '',
@@ -148,10 +152,7 @@ private function setPriority(BaseBuilder $builder, array $priority): BaseBuilder
             } else {
                 $builder->orderBy(
                     'FIELD(priority, '
-                    . implode(
-                        ',',
-                        array_map(static fn ($value) => "'{$value}'", $priority),
-                    )
+                    . implode(',', $escapedPriority)
                     . ')',
                     '',
                     false,
diff --git a/tests/Models/QueueJobModelTest.php b/tests/Models/QueueJobModelTest.php
index 4d61f7e..00dab22 100644
--- a/tests/Models/QueueJobModelTest.php
+++ b/tests/Models/QueueJobModelTest.php
@@ -59,4 +59,22 @@ public function testSkipLockedFalse(): void
 
         $this->assertSame($sql, $result);
     }
+
+    public function testSetPriorityEscapesPriorityValues(): void
+    {
+        $model   = model(QueueJobModel::class);
+        $method  = $this->getPrivateMethodInvoker($model, 'setPriority');
+        $builder = $model->builder();
+
+        $priority = [
+            'priority_key' => "default' THEN 0 ELSE 1 END --",
+            'default',
+        ];
+
+        $result = $method($builder, $priority);
+        $sql    = $result->getCompiledSelect();
+
+        $this->assertStringContainsString($model->db->escape($priority['priority_key']), $sql);
+        $this->assertStringNotContainsString('priority_key', $sql);
+    }
 }

From 752da3ada885532a6c9d896f5a65d65003d8e280 Mon Sep 17 00:00:00 2001
From: michalsn <michal@sniatala.pl>
Date: Mon, 13 Jul 2026 19:20:51 +0200
Subject: [PATCH 2/2] fix rector

---
 src/Models/QueueJobModel.php       | 2 +-
 tests/Models/QueueJobModelTest.php | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/Models/QueueJobModel.php b/src/Models/QueueJobModel.php
index 56dbbc4..e91f2c4 100644
--- a/src/Models/QueueJobModel.php
+++ b/src/Models/QueueJobModel.php
@@ -136,7 +136,7 @@ private function setPriority(BaseBuilder $builder, array $priority): BaseBuilder
         $builder->whereIn('priority', $priority);
 
         if ($priority !== ['default']) {
-            $escapedPriority = array_map([$this->db, 'escape'], $priority);
+            $escapedPriority = array_map($this->db->escape(...), $priority);
 
             if ($this->db->DBDriver !== 'MySQLi') {
                 $builder->orderBy(
diff --git a/tests/Models/QueueJobModelTest.php b/tests/Models/QueueJobModelTest.php
index 00dab22..8dfa58e 100644
--- a/tests/Models/QueueJobModelTest.php
+++ b/tests/Models/QueueJobModelTest.php
@@ -74,7 +74,7 @@ public function testSetPriorityEscapesPriorityValues(): void
         $result = $method($builder, $priority);
         $sql    = $result->getCompiledSelect();
 
-        $this->assertStringContainsString($model->db->escape($priority['priority_key']), $sql);
-        $this->assertStringNotContainsString('priority_key', $sql);
+        $this->assertStringContainsString($model->db->escape($priority['priority_key']), (string) $sql);
+        $this->assertStringNotContainsString('priority_key', (string) $sql);
     }
 }