Spring/spring-data-jpa
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Escape JDBC styled parameters.

Browse Source 
Closes #2228
Original pull request #2229
This commit is contained in:
Michael Simons
2021-06-08 13:32:36 +02:00
committed by Jens Schauder
parent 39e72af2d5
commit 5a00192ecd
2 changed files with 20 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/main/java/org/springframework/data/jpa/repository/query/ExpressionBasedStringQuery.java
View File

@@ -35,15 +35,15 @@ import org.springframework.util.Assert;
* @author Thomas Darimont
* @author Oliver Gierke
* @author Tom Hombergs
* @author Michael J. Simons
*/
class ExpressionBasedStringQuery extends StringQuery {
private static final String EXPRESSION_PARAMETER = "?#{";
private static final String QUOTED_EXPRESSION_PARAMETER = "?__HASH__{";
private static final String EXPRESSION_PARAMETER = "$1#{";
private static final String QUOTED_EXPRESSION_PARAMETER = "$1__HASH__{";
private static final Pattern EXPRESSION_PARAMETER_QUOTING = Pattern.compile(Pattern.quote(EXPRESSION_PARAMETER));
private static final Pattern EXPRESSION_PARAMETER_UNQUOTING = Pattern.compile(Pattern
.quote(QUOTED_EXPRESSION_PARAMETER));
private static final Pattern EXPRESSION_PARAMETER_QUOTING = Pattern.compile("([:\\?])#\\{");
private static final Pattern EXPRESSION_PARAMETER_UNQUOTING = Pattern.compile("([:\\?])__HASH__\\{");
private static final String ENTITY_NAME = "entityName";
private static final String ENTITY_NAME_VARIABLE = "#" + ENTITY_NAME;

16
src/test/java/org/springframework/data/jpa/repository/query/ExpressionBasedStringQueryUnitTests.java
View File

@@ -34,6 +34,7 @@ import org.springframework.expression.spel.standard.SpelExpressionParser;
* @author Oliver Gierke
* @author Jens Schauder
* @author Mark Paluch
* @author Michael J. Simons
*/
@ExtendWith(MockitoExtension.class)
@MockitoSettings(strictness = Strictness.LENIENT)
@@ -66,7 +67,7 @@ class ExpressionBasedStringQueryUnitTests {
void shouldDetectBindParameterCountCorrectly() {
StringQuery query = new ExpressionBasedStringQuery(
"select n from NetworkServer n where (LOWER(n.name) LIKE LOWER(NULLIF(text(concat('%',:#{#networkRequest.name},'%')), '')) OR :#{#networkRequest.name} IS NULL )\"\n"
"select n from #{#entityName} n where (LOWER(n.name) LIKE LOWER(NULLIF(text(concat('%',:#{#networkRequest.name},'%')), '')) OR :#{#networkRequest.name} IS NULL )\"\n"
+ "+ \"AND (LOWER(n.server) LIKE LOWER(NULLIF(text(concat('%',:#{#networkRequest.server},'%')), '')) OR :#{#networkRequest.server} IS NULL)\"\n"
+ "+ \"AND (n.createdAt >= :#{#networkRequest.createdTime.startDateTime}) AND (n.createdAt <=:#{#networkRequest.createdTime.endDateTime})\"\n"
+ "+ \"AND (n.updatedAt >= :#{#networkRequest.updatedTime.startDateTime}) AND (n.updatedAt <=:#{#networkRequest.updatedTime.endDateTime})",
@@ -75,4 +76,17 @@ class ExpressionBasedStringQueryUnitTests {
assertThat(query.getParameterBindings()).hasSize(8);
}
@Test // GH-2228
void shouldDetectBindParameterCountCorrectlyWithJDBCStyleParameters() {
StringQuery query = new ExpressionBasedStringQuery(
"select n from #{#entityName} n where (LOWER(n.name) LIKE LOWER(NULLIF(text(concat('%',?#{#networkRequest.name},'%')), '')) OR ?#{#networkRequest.name} IS NULL )\"\n"
+ "+ \"AND (LOWER(n.server) LIKE LOWER(NULLIF(text(concat('%',?#{#networkRequest.server},'%')), '')) OR ?#{#networkRequest.server} IS NULL)\"\n"
+ "+ \"AND (n.createdAt >= ?#{#networkRequest.createdTime.startDateTime}) AND (n.createdAt <=?#{#networkRequest.createdTime.endDateTime})\"\n"
+ "+ \"AND (n.updatedAt >= ?#{#networkRequest.updatedTime.startDateTime}) AND (n.updatedAt <=?#{#networkRequest.updatedTime.endDateTime})",
metadata, SPEL_PARSER);
assertThat(query.getParameterBindings()).hasSize(8);
}
}