Spring/spring-data-relational
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SqlIdentifierParameterSource now sanitizes identifier names.

Browse Source 
Closes #1405
See #1406
Original pull request #1415
This commit is contained in:
Jens Schauder
2023-01-23 15:49:28 +01:00
committed by Mark Paluch
parent b8e8c996b6
commit 427fc4d83b
6 changed files with 70 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
spring-data-jdbc/src/main/java/org/springframework/data/jdbc/core/convert/BindParameterNameSanitizer.java Normal file
View File

@@ -0,0 +1,37 @@
/*
* Copyright 2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.data.jdbc.core.convert;
import java.util.regex.Pattern;
/**
* Sanitizes the name of bind parameters, so they don't contain any illegal characters.
*
* @author Jens Schauder
*
* @since 3.0
*/
enum BindParameterNameSanitizer {
INSTANCE;
private static final Pattern parameterPattern = Pattern.compile("\\W");
String sanitize(String rawName) {
return parameterPattern.matcher(rawName).replaceAll("");
}
}

3
spring-data-jdbc/src/main/java/org/springframework/data/jdbc/core/convert/SqlGenerator.java
View File

@@ -66,7 +66,6 @@ class SqlGenerator {
static final SqlIdentifier IDS_SQL_PARAMETER = SqlIdentifier.unquoted("ids");
static final SqlIdentifier ROOT_ID_PARAMETER = SqlIdentifier.unquoted("rootId");
private static final Pattern parameterPattern = Pattern.compile("\\W");
private final RelationalPersistentEntity<?> entity;
private final MappingContext<RelationalPersistentEntity<?>, RelationalPersistentProperty> mappingContext;
private final RenderContext renderContext;
@@ -159,7 +158,7 @@ class SqlGenerator {
}
private BindMarker getBindMarker(SqlIdentifier columnName) {
return SQL.bindMarker(":" + parameterPattern.matcher(renderReference(columnName)).replaceAll(""));
return SQL.bindMarker(":" + BindParameterNameSanitizer.INSTANCE.sanitize(renderReference(columnName)));
}
/**

2
spring-data-jdbc/src/main/java/org/springframework/data/jdbc/core/convert/SqlIdentifierParameterSource.java
View File

@@ -68,7 +68,7 @@ class SqlIdentifierParameterSource extends AbstractSqlParameterSource {
void addValue(SqlIdentifier identifier, Object value, int sqlType) {
identifiers.add(identifier);
String name = identifier.getReference(identifierProcessing);
String name = BindParameterNameSanitizer.INSTANCE.sanitize(identifier.getReference(identifierProcessing));
namesToValues.put(name, value);
registerSqlType(name, sqlType);
}

4
spring-data-jdbc/src/main/java/org/springframework/data/jdbc/core/convert/SqlParametersFactory.java
View File

@@ -95,8 +95,8 @@ public class SqlParametersFactory {
*/
<T> SqlIdentifierParameterSource forUpdate(T instance, Class<T> domainType) {
return getParameterSource(instance, getRequiredPersistentEntity(domainType), "", RelationalPersistentProperty::isInsertOnly,
dialect.getIdentifierProcessing());
return getParameterSource(instance, getRequiredPersistentEntity(domainType), "",
RelationalPersistentProperty::isInsertOnly, dialect.getIdentifierProcessing());
}
/**