Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix #18 SQLInjection vulnerability cleared
Pattern and Option DAOs re-written to a common key-value base class.  Using composite primary key in place of surrogate key.
  • Loading branch information
David Sowerby committed Jan 18, 2016
1 parent b64a15b commit c1e8486
Show file tree
Hide file tree
Showing 27 changed files with 795 additions and 578 deletions.
57 changes: 57 additions & 0 deletions src/main/java/uk/q3c/krail/jpa/i18n/DefaultJpaPatternDao.java
@@ -0,0 +1,57 @@
/*
*
* * Copyright (c) 2016. David Sowerby
* *
* * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
* * the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
* *
* * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
* * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
* * specific language governing permissions and limitations under the License.
*
*/

package uk.q3c.krail.jpa.i18n;

import com.google.inject.Inject;
import org.apache.onami.persist.EntityManagerProvider;
import org.apache.onami.persist.PersistenceUnitModule;
import uk.q3c.krail.i18n.PatternCacheKey;
import uk.q3c.krail.jpa.persist.BaseJpaKeyValueDao;

import javax.annotation.Nonnull;
import java.util.Optional;

/**
* The default implementation of {@link JpaPatternDao}. The {@code entityManagerProvider} and {@code dao} are bound by {@link PersistenceUnitModule} to the
* annotation which is used in the injection of this class. (For example, if an instance of this class is annotated with @Jpa1, then the constructor parameters
* will also be bound with @Jpa1)
* <p>
* Created by David Sowerby on 15/04/15.
*/
public class DefaultJpaPatternDao extends BaseJpaKeyValueDao<PatternId, PatternCacheKey, JpaPatternEntity> implements JpaPatternDao {


@Inject
protected DefaultJpaPatternDao(EntityManagerProvider entityManagerProvider) {
super(entityManagerProvider, JpaPatternEntity.class);
}


@Override
protected JpaPatternEntity newEntity(PatternCacheKey cacheKey, String value) {
return new JpaPatternEntity(cacheKey, value);
}

@Override
protected PatternId newId(PatternCacheKey cacheKey) {
return new PatternId(cacheKey);
}


@Nonnull
@Override
public Optional<String> getValue(@Nonnull PatternCacheKey cacheKey) {
return getValueAsString(cacheKey);
}
}
152 changes: 0 additions & 152 deletions src/main/java/uk/q3c/krail/jpa/i18n/DefaultJpaPatternDao_LongInt.java

This file was deleted.

18 changes: 9 additions & 9 deletions src/main/java/uk/q3c/krail/jpa/i18n/JpaPatternDao.java
@@ -1,27 +1,27 @@
/*
* Copyright (c) 2015. David Sowerby
*
* Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
* * Copyright (c) 2016. David Sowerby
* *
* * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
* * the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
* *
* * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
* * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
* * specific language governing permissions and limitations under the License.
*
* Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
* an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
* specific language governing permissions and limitations under the License.
*/

package uk.q3c.krail.jpa.i18n;

import uk.q3c.krail.i18n.PatternCacheKey;
import uk.q3c.krail.i18n.PatternDao;

import java.util.Optional;

/**
* JPA specific interface for {@link PatternDao} to enable binding alternatives
* <p>
* Created by David Sowerby on 15/04/15.
*/
public interface JpaPatternDao extends PatternDao {

Optional<PatternEntity_LongInt> find(PatternCacheKey cacheKey);
JpaPatternEntity find(PatternCacheKey cacheKey);
}
70 changes: 70 additions & 0 deletions src/main/java/uk/q3c/krail/jpa/i18n/JpaPatternEntity.java
@@ -0,0 +1,70 @@
/*
*
* * Copyright (c) 2016. David Sowerby
* *
* * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
* * the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
* *
* * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
* * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
* * specific language governing permissions and limitations under the License.
*
*/

package uk.q3c.krail.jpa.i18n;

import uk.q3c.krail.i18n.PatternCacheKey;

import javax.persistence.EmbeddedId;
import javax.persistence.Entity;
import javax.persistence.Version;

/**
* An entity to represent an I18N key, Locale and value combination
* <p>
* Created by David Sowerby on 15/04/15.
*/

@Entity
public class JpaPatternEntity implements KeyValueEntity<PatternId, Integer> {

@EmbeddedId
private PatternId id;
private String value;
@Version
private Integer version;

protected JpaPatternEntity() {
}

public JpaPatternEntity(PatternCacheKey cacheKey, String value) {
id = new PatternId(cacheKey);
this.value = value;
}

public String getI18nkey() {
return id.getI18nkey();
}

public String getValue() {
return value;
}

public void setValue(String value) {
this.value = value;
}

public String getLocale() {
return id.getLocale();
}

@Override
public PatternId getId() {
return id;
}

@Override
public Integer getVersion() {
return version;
}
}
26 changes: 26 additions & 0 deletions src/main/java/uk/q3c/krail/jpa/i18n/KeyValueEntity.java
@@ -0,0 +1,26 @@
/*
*
* * Copyright (c) 2016. David Sowerby
* *
* * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with
* * the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0
* *
* * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on
* * an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the
* * specific language governing permissions and limitations under the License.
*
*/

package uk.q3c.krail.jpa.i18n;

import uk.q3c.krail.core.data.KrailEntity;

/**
* Created by David Sowerby on 18 Jan 2016
*/
public interface KeyValueEntity<ID, VER> extends KrailEntity<ID, VER> {

String getValue();

void setValue(String value);
}

0 comments on commit c1e8486

Please sign in to comment.