Spring/spring-data-relational
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Introduce SqlSort.

Browse Source 
SqlSort allows the specification of unsafe order-by-expressions.
Order-by-expressions that are not declared unsafe are only accepted when they
either match a property or consist only of digits, letters, underscore, dot, or parentheses.

 Closes #1507
This commit is contained in:
Jens Schauder
2023-04-28 11:49:59 +02:00
parent 15980174af
commit a26557e76b
7 changed files with 517 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
spring-data-jdbc/src/main/java/org/springframework/data/jdbc/core/convert/QueryMapper.java
View File

@@ -41,6 +41,7 @@ import org.springframework.data.relational.core.query.CriteriaDefinition;
import org.springframework.data.relational.core.query.CriteriaDefinition.Comparator;
import org.springframework.data.relational.core.query.ValueFunction;
import org.springframework.data.relational.core.sql.*;
import org.springframework.data.relational.domain.SqlSort;
import org.springframework.data.util.Pair;
import org.springframework.data.util.TypeInformation;
import org.springframework.jdbc.core.namedparam.MapSqlParameterSource;
@@ -92,13 +93,22 @@ public class QueryMapper {
for (Sort.Order order : sort) {
Field field = createPropertyField(entity, SqlIdentifier.unquoted(order.getProperty()), this.mappingContext);
OrderByField orderBy = OrderByField.from(table.column(field.getMappedColumnName()))
OrderByField simpleOrderByField = createSimpleOrderByField(table, entity, order);
OrderByField orderBy = simpleOrderByField
.withNullHandling(order.getNullHandling());
mappedOrder.add(order.isAscending() ? orderBy.asc() : orderBy.desc());
}
return mappedOrder;
}
private OrderByField createSimpleOrderByField(Table table, RelationalPersistentEntity<?> entity, Sort.Order order) {
SqlSort.validate(order);
Field field = createPropertyField(entity, SqlIdentifier.unquoted(order.getProperty()), this.mappingContext);
return OrderByField.from(table.column(field.getMappedColumnName()));
}
/**