You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@empire-db.apache.org by do...@apache.org on 2025/10/03 22:22:42 UTC
(empire-db) branch master updated: EMPIREDB-478 prepareParams: safety checks added
This is an automated email from the ASF dual-hosted git repository.
doebele pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/empire-db.git
The following commit(s) were added to refs/heads/master by this push:
new 3b0adab6 EMPIREDB-478 prepareParams: safety checks added
3b0adab6 is described below
commit 3b0adab68de577a22338ba1749266aad21f347f2
Author: Rainer Döbele <rd...@users.noreply.github.com>
AuthorDate: Sat Oct 4 00:22:39 2025 +0200
EMPIREDB-478
prepareParams: safety checks added
---
.../org/apache/empire/commons/ColumnUtils.java | 46 +++++++++++++++-------
.../java/org/apache/empire/db/DBColumnExpr.java | 5 ++-
.../apache/empire/db/expr/column/DBValueExpr.java | 21 +++++++---
.../empire/db/expr/compare/DBCompareColExpr.java | 15 +++++--
.../empire/db/expr/compare/DBCompareExpr.java | 3 ++
5 files changed, 67 insertions(+), 23 deletions(-)
diff --git a/empire-db/src/main/java/org/apache/empire/commons/ColumnUtils.java b/empire-db/src/main/java/org/apache/empire/commons/ColumnUtils.java
index 7530faed..375a772b 100644
--- a/empire-db/src/main/java/org/apache/empire/commons/ColumnUtils.java
+++ b/empire-db/src/main/java/org/apache/empire/commons/ColumnUtils.java
@@ -26,8 +26,10 @@ import java.util.regex.Pattern;
import org.apache.empire.data.Column;
import org.apache.empire.data.ColumnExpr;
import org.apache.empire.data.DataType;
+import org.apache.empire.db.DBColumn;
import org.apache.empire.db.DBColumnExpr;
import org.apache.empire.db.expr.column.DBFuncExpr;
+import org.apache.empire.exceptions.InvalidArgumentException;
import org.apache.empire.exceptions.NotSupportedException;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -180,15 +182,15 @@ public class ColumnUtils
/**
* Returns the sort expression for a given column
- * If no sort expression is explicitly set then the columnExpr itself is returned
+ * If no sort expression is explicitly set then the column itself is returned
* The returned expression should be assigned to an DBCommand.orderBy() function.
*
- * @param columnExpr the column for which to retrieve the sort expression
- * @return the sort expression or the columnExp if not sort expression is set
+ * @param column the column for which to retrieve the sort expression
+ * @return the sort expression or the column itself if not sort expression is set
*/
- public static DBColumnExpr getSortExpr(DBColumnExpr columnExpr)
+ public static DBColumnExpr getSortExpr(DBColumn column)
{
- Object value = instance.getColumnAttribute(columnExpr, Column.COLATTR_SORTEXPRESSION);
+ Object value = instance.getColumnAttribute(column, Column.COLATTR_SORTEXPRESSION);
// create a sort expression
if (value instanceof DBColumnExpr)
{ // return expression
@@ -197,26 +199,42 @@ public class ColumnUtils
else if ((value instanceof String) && ((String)value).indexOf('?')>=0)
{ // create a sort function expression
String sortFunctionTemplate = StringUtils.toString(value);
- return new DBFuncExpr(columnExpr, sortFunctionTemplate, null, false, columnExpr.getDataType());
+ return new DBFuncExpr(column, sortFunctionTemplate, null, false, column.getDataType());
}
else if (value!=null)
{ // unknown value
log.warn("Invalid value for {}: {}", Column.COLATTR_SORTEXPRESSION, value);
}
// not changed
- return columnExpr;
+ return column;
}
/**
- * Sets a sort function template for a particular DBColumExpr
- * @param columnExpr the column expression
- * @param sortFunctionTemplate the template which must contain a ? which will be replaced by the sort expression
- * @return return the columnExpr
+ * Sets a sort function expression for a given column
+ * @param column the column for which to set the sort expression
+ * @param sortExpression the expression which to use for sorting
+ * @return return the column
*/
- public static <T extends DBColumnExpr> T setSortExpr(T columnExpr, DBColumnExpr sortExpression)
+ public static <T extends DBColumn> T setSortExpr(T column, DBColumnExpr sortExpression)
{ // set sort expression
- columnExpr.setAttribute(Column.COLATTR_SORTEXPRESSION, sortExpression);
- return columnExpr;
+ column.setAttribute(Column.COLATTR_SORTEXPRESSION, sortExpression);
+ return column;
+ }
+
+ /**
+ * Sets a sort function template for a given column
+ * @param column the column for which to set the sort expression
+ * @param sortFunctionTemplate the template which must contain a ? which will be replaced with the column name
+ * @return return the column
+ */
+ public static <T extends DBColumn> T setSortExpr(T column, String sortFunctionTemplate)
+ {
+ // check param
+ if (sortFunctionTemplate!=null && sortFunctionTemplate.indexOf('?')<0)
+ throw new InvalidArgumentException("sortFunctionTemplate", sortFunctionTemplate);
+ // set sort expression
+ column.setAttribute(Column.COLATTR_SORTEXPRESSION, sortFunctionTemplate);
+ return column;
}
/**
diff --git a/empire-db/src/main/java/org/apache/empire/db/DBColumnExpr.java b/empire-db/src/main/java/org/apache/empire/db/DBColumnExpr.java
index 5deb525a..5f327f69 100644
--- a/empire-db/src/main/java/org/apache/empire/db/DBColumnExpr.java
+++ b/empire-db/src/main/java/org/apache/empire/db/DBColumnExpr.java
@@ -1480,8 +1480,11 @@ public abstract class DBColumnExpr extends DBExpr
*/
protected boolean isLiteralValue(Object value)
{
+ // Already a DBCmdParam
+ if (value instanceof DBCmdParam)
+ return false;
// Cannot use DBExpr or DBSystemDate as parameter
- if (value==null || value instanceof DBCmdParam || value instanceof DBExpr || value instanceof DBDatabase.DBSystemDate)
+ if (value==null || value instanceof DBExpr || value instanceof DBDatabase.DBSystemDate)
return false;
// check immutable
return ClassUtils.isImmutableClass(value.getClass());
diff --git a/empire-db/src/main/java/org/apache/empire/db/expr/column/DBValueExpr.java b/empire-db/src/main/java/org/apache/empire/db/expr/column/DBValueExpr.java
index fd56226a..8c1ea89e 100644
--- a/empire-db/src/main/java/org/apache/empire/db/expr/column/DBValueExpr.java
+++ b/empire-db/src/main/java/org/apache/empire/db/expr/column/DBValueExpr.java
@@ -20,7 +20,6 @@ package org.apache.empire.db.expr.column;
import java.util.Set;
-import org.apache.empire.commons.ClassUtils;
import org.apache.empire.commons.ObjectUtils;
import org.apache.empire.commons.StringUtils;
// Java
@@ -103,7 +102,7 @@ public class DBValueExpr extends DBColumnExpr
{ // value of DataType.UNKNOWN cannot be changed
throw new PropertyReadOnlyException("value");
}
- else if (value!=null && !ClassUtils.isImmutableClass(value.getClass()))
+ else if (value!=null && !isLiteralValue(value))
{ // Must be a simple value
throw new InvalidArgumentException("value", value);
}
@@ -242,12 +241,14 @@ public class DBValueExpr extends DBColumnExpr
* Otherwise it may be automatically replaced by a parameter ?
* @return self (this)
*/
- public DBValueExpr literally()
+ public DBValueExpr literal()
{
this.literal = true;
// remove param
- if (this.value instanceof DBCmdParam)
+ if (this.value instanceof DBCmdParam) {
this.value = ((DBCmdParam)value).getValue();
+ this.name = null;
+ }
// return self
return this;
}
@@ -273,8 +274,18 @@ public class DBValueExpr extends DBColumnExpr
// literal mode
if (getDataType()==DataType.UNKNOWN || literal)
return;
+ // value already a DBCmdParam
+ if (value instanceof DBCmdParam)
+ { // check same command
+ if (cmd==((DBCmdParam)value).getCmd())
+ return; // already set
+ // value expression used in multiple command
+ log.warn("Unexpected behaviour: ValueExpr has alredy been used for a different command. Switching to literal mode!");
+ literal();
+ return;
+ }
// Cannot use DBExpr or DBSystemDate as parameter
- if (value==null || value instanceof DBCmdParam || value instanceof DBExpr || value instanceof DBDatabase.DBSystemDate)
+ if (value==null || value instanceof DBExpr || value instanceof DBDatabase.DBSystemDate)
return;
// Add command param
this.value = cmd.addParam(getDataType(), value);
diff --git a/empire-db/src/main/java/org/apache/empire/db/expr/compare/DBCompareColExpr.java b/empire-db/src/main/java/org/apache/empire/db/expr/compare/DBCompareColExpr.java
index b5f3c5c1..3e5f4fcd 100644
--- a/empire-db/src/main/java/org/apache/empire/db/expr/compare/DBCompareColExpr.java
+++ b/empire-db/src/main/java/org/apache/empire/db/expr/compare/DBCompareColExpr.java
@@ -34,8 +34,8 @@ import org.apache.empire.db.DBExpr;
import org.apache.empire.db.DBRowSet;
import org.apache.empire.db.DBSQLBuilder;
import org.apache.empire.db.expr.column.DBAliasExpr;
-import org.apache.empire.db.expr.column.DBPreparable;
import org.apache.empire.db.expr.column.DBFuncExpr;
+import org.apache.empire.db.expr.column.DBPreparable;
import org.apache.empire.dbms.DBSqlPhrase;
@@ -137,7 +137,7 @@ public class DBCompareColExpr extends DBCompareExpr
}
/**
- * wraps the expression in parenthesises
+ * wraps the expression in Parenthesis
*/
public DBCompareColExpr parenthesis()
{
@@ -160,8 +160,17 @@ public class DBCompareColExpr extends DBCompareExpr
((DBPreparable)value).prepareParams(cmd, this);
return; // we're done
}
+ // value already a DBCmdParam
+ if (value instanceof DBCmdParam)
+ { // check same command
+ if (cmd==((DBCmdParam)value).getCmd())
+ return; // already set
+ // value expression used in multiple command
+ log.warn("Unexpected behaviour: DBCompareExpr has alredy been used for a different command. Detaching from old command!");
+ value = ((DBCmdParam)value).getValue();
+ }
// Cannot use DBExpr or DBSystemDate as parameter
- if (value==null || value instanceof DBCmdParam || value instanceof DBExpr || value instanceof DBDatabase.DBSystemDate)
+ if (value==null || value instanceof DBExpr || value instanceof DBDatabase.DBSystemDate)
return;
// check operator
switch(cmpop)
diff --git a/empire-db/src/main/java/org/apache/empire/db/expr/compare/DBCompareExpr.java b/empire-db/src/main/java/org/apache/empire/db/expr/compare/DBCompareExpr.java
index dfca4e32..8243650a 100644
--- a/empire-db/src/main/java/org/apache/empire/db/expr/compare/DBCompareExpr.java
+++ b/empire-db/src/main/java/org/apache/empire/db/expr/compare/DBCompareExpr.java
@@ -23,6 +23,8 @@ import org.apache.empire.db.DBCommand;
import org.apache.empire.db.DBExpr;
import org.apache.empire.db.DBRowSet;
import org.apache.empire.db.expr.column.DBPreparable;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
/**
* This class is a common base class for all SQL filter constraints classes<br>
@@ -30,6 +32,7 @@ import org.apache.empire.db.expr.column.DBPreparable;
public abstract class DBCompareExpr extends DBExpr implements DBPreparable
{
// *Deprecated* private static final long serialVersionUID = 1L;
+ protected static final Logger log = LoggerFactory.getLogger(DBCompareExpr.class);
public abstract boolean isMutuallyExclusive(DBCompareExpr other);