SpringCloud/spring-cloud-task
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Added sort validation

Browse Source 
This commit now validates that the value passed via a PageRequest to
sort the results by is a valid value.

Resolves #739

Fixed to allow for all letter cases
This commit is contained in:
Michael Minella
2020-11-03 10:50:25 -06:00
committed by Glenn Renfro
parent bb7d235900
commit 704b8df2ad
2 changed files with 52 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
spring-cloud-task-core/src/main/java/org/springframework/cloud/task/repository/dao/JdbcTaskExecutionDao.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2015-2019 the original author or authors.
* Copyright 2015-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@ import java.sql.Types;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
import java.util.HashSet;
import java.util.LinkedHashMap;
import java.util.List;
import java.util.Map;
@@ -58,6 +59,7 @@ import org.springframework.util.StringUtils;
* @author Gunnar Hillert
* @author David Turanski
* @author Ilayaperumal Gopinathan
* @author Michael Minella
*/
public class JdbcTaskExecutionDao implements TaskExecutionDao {
@@ -161,6 +163,21 @@ public class JdbcTaskExecutionDao implements TaskExecutionDao {
private DataFieldMaxValueIncrementer taskIncrementer;
private static final Set<String> validSortColumns = new HashSet<>(10);
static {
validSortColumns.add("TASK_EXECUTION_ID");
validSortColumns.add("START_TIME");
validSortColumns.add("END_TIME");
validSortColumns.add("TASK_NAME");
validSortColumns.add("EXIT_CODE");
validSortColumns.add("EXIT_MESSAGE");
validSortColumns.add("ERROR_MESSAGE");
validSortColumns.add("LAST_UPDATED");
validSortColumns.add("EXTERNAL_EXECUTION_ID");
validSortColumns.add("PARENT_EXECUTION_ID");
}
/**
* Initializes the JdbcTaskExecutionDao.
* @param dataSource used by the dao to execute queries and update the tables.
@@ -511,8 +528,13 @@ public class JdbcTaskExecutionDao implements TaskExecutionDao {
if (sort != null) {
for (Sort.Order sortOrder : sort) {
sortOrderMap.put(sortOrder.getProperty(),
if (validSortColumns.contains(sortOrder.getProperty().toUpperCase())) {
sortOrderMap.put(sortOrder.getProperty(),
sortOrder.isAscending() ? Order.ASCENDING : Order.DESCENDING);
}
else {
throw new IllegalArgumentException(String.format("Invalid sort option selected: %s", sortOrder.getProperty()));
}
}
}