Parameter expressions

[dstepanov]

No description provided.

[sonarcloud]

Quality Gate failed

Failed conditions

16.7% Duplication on New Code (required ≤ 10%)
3 New Critical Issues (required ≤ 0)
2 New Bugs (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint

[kareemelzayat]

I don't know if this is covered here, but I noticed that literalExpressions DO NOT get parameterized on Hibernate/JPA; rather they are put literally in the SQL query.

I don't know if that's the whole intent behind the literal expression but to me it seems very odd. Why would we want literal data transmitted through the network and risk SQL injections?!

[dstepanov]

Are you talking about our criteria implementation or the Hibernate one? Which one does what?

[kareemelzayat]

I am really not sure which implementation is causing the issue. But I enabled the SQL logs via hibernate.show_sql=true and I could see the literal expression is written as is, instead of a ?. For example, CONCAT(entity_.name, literal) instead of CONCAT(entity_.name, ?)

[dstepanov]

If the criteria builder is from the Hibernate it's a Hibernate issue

[kareemelzayat]

@dstepanov I also suspect so! Do you have a link for the Hibernate repository so I can file an issue there?

[dstepanov]

@kareemelzayat https://hibernate.atlassian.net/browse/HHH

[sonarcloud]

Quality Gate failed

Failed conditions
3 New Critical Issues (required ≤ 0)

See analysis details on SonarCloud

Catch issues before they fail your Quality Gate with our IDE extension SonarLint