You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2026/08/28 09:56:17 UTC
(syncope) 03/03: Ensuring to accept only valid sort clauses for Task search
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git
commit 04408c57c320cfdcdd74087781d1e6cefcd03144
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Fri Aug 28 11:49:37 2026 +0200
Ensuring to accept only valid sort clauses for Task search
---
.../core/persistence/jpa/dao/JPATaskDAO.java | 33 +++++++++++++---------
.../core/persistence/neo4j/dao/Neo4jTaskDAO.java | 32 ++++++++++++---------
2 files changed, 38 insertions(+), 27 deletions(-)
diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java
index 17bd64981c..b2da95b3f4 100644
--- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java
+++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java
@@ -255,8 +255,8 @@ public class JPATaskDAO implements TaskDAO {
StringBuilder subStatement = new StringBuilder();
orderByClauses.forEach(clause -> {
- String field = clause.getProperty().trim();
- switch (field) {
+ String field = null;
+ switch (clause.getProperty().trim()) {
case "latestExecStatus":
field = "status";
break;
@@ -270,17 +270,24 @@ public class JPATaskDAO implements TaskDAO {
break;
default:
- Field beanField = ReflectionUtils.findField(beanClass, field);
- if (beanField != null
- && (beanField.getAnnotation(ManyToOne.class) != null
- || beanField.getAnnotation(OneToMany.class) != null
- || beanField.getAnnotation(OneToOne.class) != null)) {
+ Field beanField = ReflectionUtils.findField(beanClass, clause.getProperty().trim());
+ if (beanField != null) {
+ field = beanField.getName();
- field += "_id";
+ if (beanField.getAnnotation(ManyToOne.class) != null
+ || beanField.getAnnotation(OneToMany.class) != null
+ || beanField.getAnnotation(OneToOne.class) != null) {
+
+ field += "_id";
+ }
}
}
- subStatement.append(prefix).append(field).append(' ').append(clause.getDirection().name()).append(',');
+ if (field == null) {
+ LOG.debug("Unsupported ORDER BY clause: {}", clause.getProperty().trim());
+ } else {
+ subStatement.append(prefix).append(field).append(' ').append(clause.getDirection().name()).append(',');
+ }
});
StringBuilder statement = new StringBuilder(" ORDER BY ");
@@ -412,7 +419,7 @@ public class JPATaskDAO implements TaskDAO {
map(realmSearchDAO::findByFullPath).
filter(Optional::isPresent).
flatMap(r -> realmSearchDAO.findDescendants(r.get().getFullPath(), null).
- stream()).
+ stream()).
map(Realm::getKey).
distinct().
map(realmKey -> "?" + setParameter(parameters, realmKey)).
@@ -438,9 +445,9 @@ public class JPATaskDAO implements TaskDAO {
boolean orderByTaskExecInfo = pageable.getSort().stream().
anyMatch(clause -> clause.getProperty().equals("start")
- || clause.getProperty().equals("end")
- || clause.getProperty().equals("latestExecStatus")
- || clause.getProperty().equals("status"));
+ || clause.getProperty().equals("end")
+ || clause.getProperty().equals("latestExecStatus")
+ || clause.getProperty().equals("status"));
StringBuilder queryString = buildFindAllQuery(
type,
diff --git a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jTaskDAO.java b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jTaskDAO.java
index 1d934be33d..696293c9ba 100644
--- a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jTaskDAO.java
+++ b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jTaskDAO.java
@@ -248,8 +248,8 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO {
protected String toOrderByStatement(final Stream<Sort.Order> orderByClauses) {
StringBuilder subStatement = new StringBuilder();
orderByClauses.forEach(clause -> {
- String field = clause.getProperty().trim();
- switch (field) {
+ String field = null;
+ switch (clause.getProperty().trim()) {
case "latestExecStatus":
field = "status";
break;
@@ -265,7 +265,11 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO {
default:
}
- subStatement.append("p.").append(field).append(' ').append(clause.getDirection().name()).append(',');
+ if (field == null) {
+ LOG.debug("Unsupported ORDER BY clause: {}", clause.getProperty().trim());
+ } else {
+ subStatement.append("p.").append(field).append(' ').append(clause.getDirection().name()).append(',');
+ }
});
StringBuilder statement = new StringBuilder(" ORDER BY ");
@@ -377,7 +381,7 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO {
map(realmSearchDAO::findByFullPath).
filter(Optional::isPresent).
flatMap(r -> realmSearchDAO.findDescendants(r.get().getFullPath(), null).
- stream()).
+ stream()).
map(Realm::getKey).
distinct();
@@ -500,21 +504,21 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO {
t.getActions().stream().filter(act -> !pullTask.getActions().contains(act)).
forEach(impl -> deleteRelationship(Neo4jPullTask.NODE,
- Neo4jImplementation.NODE,
- pullTask.getKey(),
- impl.getKey(),
- Neo4jPullTask.PULL_TASK_INBOUND_ACTIONS_REL));
+ Neo4jImplementation.NODE,
+ pullTask.getKey(),
+ impl.getKey(),
+ Neo4jPullTask.PULL_TASK_INBOUND_ACTIONS_REL));
});
case Neo4jPushTask pushTask -> {
neo4jTemplate.findById(pushTask.getKey(), Neo4jPushTask.class).
ifPresent(t -> t.getActions().stream().filter(act -> !pushTask.getActions().contains(act)).
- forEach(impl -> deleteRelationship(
- Neo4jPushTask.NODE,
- Neo4jImplementation.NODE,
- pushTask.getKey(),
- impl.getKey(),
- Neo4jPushTask.PUSH_TASK_PUSH_ACTIONS_REL)));
+ forEach(impl -> deleteRelationship(
+ Neo4jPushTask.NODE,
+ Neo4jImplementation.NODE,
+ pushTask.getKey(),
+ impl.getKey(),
+ Neo4jPushTask.PUSH_TASK_PUSH_ACTIONS_REL)));
}
case Neo4jMacroTask macroTask ->