You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@grails.apache.org by "jamesfredley (via GitHub)" <gi...@apache.org> on 2026/07/10 22:08:39 UTC

[PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

jamesfredley opened a new pull request, #15968:
URL: https://github.com/apache/grails-core/pull/15968

   ## Description
   
   ### What was found
   
   | Problem | Impact |
   | --- | --- |
   | Developers may interpolate values into HQL via GString | Injection risk / unsafe query patterns |
   | Google Doc 2.6 listed GORM query safety as not covered | No current open PR |
   | Hard failures would break existing apps | Prefer warn-first starter |
   
   ### What changed
   
   | Area | Change |
   | --- | --- |
   | Utility | `GormQuerySafetyWarnings` detects GString queries with values |
   | Behavior | Logs a one-time warning per operation/query shape |
   | Hibernate path | Wire into Hibernate GORM static query APIs |
   | Docs | Securing against attacks + executeQuery/find refs + upgrade note |
   | Tests | Warning once / no-warn for plain strings |
   
   ### Out of scope / follow-up
   
   | Topic | Status |
   | --- | --- |
   | Compile-time AST ban of unsafe GString HQL | Follow-up |
   | Throwing by default | Not this PR (warn only) |
   | Full internal query audit | Follow-up |
   
   ### Related MD topics
   
   | Source | Topic |
   | --- | --- |
   | Google Doc 2.6 | GORM query safety audit |
   
   ## Contributor Checklist
   
   ### Issue and Scope
   - [x] Background explains query-safety gap.
   - [x] Warn-only, non-breaking starter.
   - [x] Single focused change.
   - [x] Targets `8.0.x`.
   
   ### Code Quality
   - [x] Unit tests for warning helper.
   - [x] Focused datamapping tests intended for CI.
   - [x] No mass reformatting.
   - [x] AI starting point labeled.
   
   ### Licensing and Attribution
   - [x] Apache License 2.0.
   - [x] Contributor rights confirmed.
   - [x] `ai-generated-starting-point` label applied.
   
   ### Documentation
   - [x] Security and ref docs updated.
   - [x] PR description explains what changed and why.
   
   Assisted-by: Sisyphus:xai/grok-4.5 [gpt-coding]


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#issuecomment-5005593017

   ## ✅ All tests passed ✅
   
   🏷️ Commit: 2439fb3446c1db71082488cc153f811aac6d2e69
   ▶️ Tests:  13657 executed
   ⚪️ Checks: 59/59 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#issuecomment-4986304848

   ## ✅ All tests passed ✅
   
   🏷️ Commit: 7ae397fd9455e53b6f873a05066cb2bd5520e6e7
   ▶️ Tests:  55592 executed
   ⚪️ Checks: 59/59 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "davydotcom (via GitHub)" <gi...@apache.org>.
davydotcom closed pull request #15968: Warn once on GString-interpolated GORM HQL queries
URL: https://github.com/apache/grails-core/pull/15968


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "testlens-app[bot] (via GitHub)" <gi...@apache.org>.
testlens-app[bot] commented on PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#issuecomment-4940660866

   ## ✅ All tests passed ✅
   
   🏷️ Commit: 8fdd94d3400abf0beccc67db128c91a066091d86
   ▶️ Tests:  29051 executed
   ⚪️ Checks: 60/60 completed
   
   ---
   _Learn more about TestLens at [testlens.app](https://testlens.app)._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "borinquenkid (via GitHub)" <gi...@apache.org>.
borinquenkid commented on PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#issuecomment-4985752612

   > ## Review feedback addressed
   > Pushed `244cecd5a5` (code) and `7ae397fd94` (docs), after merging the latest `8.0.x`.
   > 
   > **Copilot review comments (all three resolved):**
   > 
   > 1. _Unbounded static set / builds the query shape even when warn logging is disabled_ - `warnIfGStringQuery` now checks `logger.warnEnabled` before building the query shape or warning key and returns early on the disabled path. `WARNED_GSTRING_QUERY_SHAPES` is bounded by `MAX_WARNED_QUERY_SHAPES` (1000); the size-check / clear-on-overflow / `add` run inside a `synchronized` block so it stays thread-safe and cannot grow without limit. Added a `GormQuerySafetyWarningsSpec` case that floods >1000 distinct shapes and asserts a previously-warned shape warns again after the bounded reset.
   > 2. _Message hard-codes "HQL" though the helper also runs for native SQL_ - the warning now reads "GString-interpolated query passed to [...]" (datastore-neutral).
   > 3. _No Hibernate-module test asserting the warning fires once without interpolated values_ - added `HibernateGormStaticApiSpec` "Test GString query warning is emitted once without interpolated values" using a Logback `ListAppender`; it runs the same `GString` `executeQuery` twice and asserts exactly one `WARN`, that it contains `GString-interpolated query`, and that it does **not** contain the interpolated secret. The module's test binding moved to `logback-classic` with a `logback-test.xml` mirroring the previous slf4j-simple levels so suite log output is unchanged.
   > 
   > **@borinquenkid - Hibernate 5 / Neo4j scope:** you're right that the wiring is Hibernate 7-only, so I did **not** over-promise it. The user-facing docs (`securingAgainstAttacks.adoc`, `executeQuery.adoc`, `find.adoc`) are now explicitly scoped to "when using Hibernate 7", and the misleading GString example that was mislabeled as SQL-injection-vulnerable was removed (an unquoted `GString` value is parameter-bound by GORM, not spliced into the HQL text). The warn-only helper itself lives in shared `grails-datamapping-core` (`org.grails.datastore.gorm.query.GormQuerySafetyWarnings`), so it can be reused by the Hibernate 5 / Neo4j static APIs later. I've intentionally left the cross-datastore + compile-time direction to your solution rather than expanding this PR's scope; happy to wire the shared helper into the other `AbstractGormStaticApi` paths in a follow-up if you'd prefer that over the compile-time approach.
   > 
   > **Note for a follow-up:** `THREAT_MODEL.md` (11 / the SQL-injection non-finding) still describes generic `GString` interpolation as injectable, which is now slightly inconsistent with the clarified guide wording. I left it untouched here since it's outside this PR's file set and is security-sensitive - worth a small consistency pass to distinguish a cleanly parameter-bound `GString` from real string concatenation/coercion.
   > 
   > Local verification: `:grails-datamapping-core:test --tests GormQuerySafetyWarningsSpec` and `:grails-data-hibernate7-core:test --tests HibernateGormStaticApiSpec` both pass.
   
   @jamesfredley  Understood, but I would prefer to tie down as much as possible sql injection threats one philosophical way or the other completely. This PR Warns  while [15971](https://github.com/apache/grails-core/pull/15971) is a compile time error. This solution is partial while 15971 covers all bindings affected by SQL Injection. If the PR extends to H5 and neo4j then they would be comparable in range and then the committers can make an apples to apples decision.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on code in PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#discussion_r3590926955


##########
grails-datamapping-core/src/main/groovy/org/grails/datastore/gorm/query/GormQuerySafetyWarnings.groovy:
##########
@@ -0,0 +1,67 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.grails.datastore.gorm.query
+
+import groovy.transform.CompileStatic
+
+import java.util.concurrent.ConcurrentHashMap
+
+import org.slf4j.Logger
+
+@CompileStatic
+final class GormQuerySafetyWarnings {
+
+    private static final String GSTRING_VALUE_PLACEHOLDER = '${...}'
+    private static final Set<String> WARNED_GSTRING_QUERY_SHAPES = Collections.newSetFromMap(new ConcurrentHashMap<String, Boolean>())
+
+    private GormQuerySafetyWarnings() {
+    }
+
+    static boolean warnIfGStringQuery(Logger logger, CharSequence query, String operation) {
+        if (!(query instanceof GString) || ((GString) query).values.length == 0) {
+            return false
+        }
+
+        String queryShape = buildQueryShape((GString) query)
+        if (!logger.warnEnabled) {
+            return false
+        }
+
+        String warningKey = "${operation}\n${queryShape}"
+        if (!WARNED_GSTRING_QUERY_SHAPES.add(warningKey)) {
+            return false
+        }

Review Comment:
   Addressed in 244cecd5a5.
   
   `warnIfGStringQuery` now checks `logger.warnEnabled` **before** building the query shape or the warning key and returns early when warn logging is disabled, so no shape/key work happens on the disabled path. The dedup set is bounded by `MAX_WARNED_QUERY_SHAPES` (1000): the size check, clear-on-overflow, and `add` run inside a `synchronized` block so it stays thread-safe and can no longer grow without limit. A new `GormQuerySafetyWarningsSpec` case floods >1000 distinct shapes and asserts a previously-warned shape warns again after the bounded reset (rather than being suppressed forever).
   



##########
grails-data-hibernate7/core/src/main/groovy/org/grails/orm/hibernate/HibernateGormStaticApi.groovy:
##########
@@ -480,6 +481,8 @@ class HibernateGormStaticApi<D> extends GormStaticApi<D> {
         if (hints.isEmpty() && querySettings != null) {
             hints = querySettings.findAll { AvailableHints.getDefinedHints().contains(it.key) }
         }
+        String operation = isNative ? 'native SQL query' : (isUpdate ? 'executeUpdate' : 'find/executeQuery')
+        GormQuerySafetyWarnings.warnIfGStringQuery(log, hql, operation)
         Map<String, Object> coercedParams = namedParams?.collectEntries { k, v -> [k.toString(), v] } ?: [:]
         def ctx = HqlQueryContext.prepare(persistentEntity, hql, coercedParams, positionalParams, querySettings, hints, isNative, isUpdate)

Review Comment:
   Addressed in 244cecd5a5.
   
   `HibernateGormStaticApiSpec` now includes "Test GString query warning is emitted once without interpolated values": it attaches a Logback `ListAppender` to the `HibernateGormStaticApi` logger, runs the same `GString` `executeQuery` twice, and asserts exactly one `WARN` is emitted, that the message contains `GString-interpolated query`, and that it does **not** contain the interpolated secret value. The module's test logging binding was switched to `logback-classic` with a `logback-test.xml` that mirrors the previous slf4j-simple levels (INFO root plus the two DEBUG categories), so the suite's log output is unchanged.
   



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "jamesfredley (via GitHub)" <gi...@apache.org>.
jamesfredley commented on PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#issuecomment-4985547352

   ## Review feedback addressed
   
   Pushed `244cecd5a5` (code) and `7ae397fd94` (docs), after merging the latest `8.0.x`.
   
   **Copilot review comments (all three resolved):**
   
   1. *Unbounded static set / builds the query shape even when warn logging is disabled* - `warnIfGStringQuery` now checks `logger.warnEnabled` before building the query shape or warning key and returns early on the disabled path. `WARNED_GSTRING_QUERY_SHAPES` is bounded by `MAX_WARNED_QUERY_SHAPES` (1000); the size-check / clear-on-overflow / `add` run inside a `synchronized` block so it stays thread-safe and cannot grow without limit. Added a `GormQuerySafetyWarningsSpec` case that floods >1000 distinct shapes and asserts a previously-warned shape warns again after the bounded reset.
   2. *Message hard-codes "HQL" though the helper also runs for native SQL* - the warning now reads "GString-interpolated query passed to [...]" (datastore-neutral).
   3. *No Hibernate-module test asserting the warning fires once without interpolated values* - added `HibernateGormStaticApiSpec` "Test GString query warning is emitted once without interpolated values" using a Logback `ListAppender`; it runs the same `GString` `executeQuery` twice and asserts exactly one `WARN`, that it contains `GString-interpolated query`, and that it does **not** contain the interpolated secret. The module's test binding moved to `logback-classic` with a `logback-test.xml` mirroring the previous slf4j-simple levels so suite log output is unchanged.
   
   **@borinquenkid - Hibernate 5 / Neo4j scope:** you're right that the wiring is Hibernate 7-only, so I did **not** over-promise it. The user-facing docs (`securingAgainstAttacks.adoc`, `executeQuery.adoc`, `find.adoc`) are now explicitly scoped to "when using Hibernate 7", and the misleading GString example that was mislabeled as SQL-injection-vulnerable was removed (an unquoted `GString` value is parameter-bound by GORM, not spliced into the HQL text). The warn-only helper itself lives in shared `grails-datamapping-core` (`org.grails.datastore.gorm.query.GormQuerySafetyWarnings`), so it can be reused by the Hibernate 5 / Neo4j static APIs later. I've intentionally left the cross-datastore + compile-time direction to your solution rather than expanding this PR's scope; happy to wire the shared helper into the other `AbstractGormStaticApi` paths in a follow-up if you'd prefer that over the compile-time approach.
   
   **Note for a follow-up:** `THREAT_MODEL.md` (11 / the SQL-injection non-finding) still describes generic `GString` interpolation as injectable, which is now slightly inconsistent with the clarified guide wording. I left it untouched here since it's outside this PR's file set and is security-sensitive - worth a small consistency pass to distinguish a cleanly parameter-bound `GString` from real string concatenation/coercion.
   
   Local verification: `:grails-datamapping-core:test --tests GormQuerySafetyWarningsSpec` and `:grails-data-hibernate7-core:test --tests HibernateGormStaticApiSpec` both pass.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#discussion_r3562267292


##########
grails-datamapping-core/src/main/groovy/org/grails/datastore/gorm/query/GormQuerySafetyWarnings.groovy:
##########
@@ -0,0 +1,67 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.grails.datastore.gorm.query
+
+import groovy.transform.CompileStatic
+
+import java.util.concurrent.ConcurrentHashMap
+
+import org.slf4j.Logger
+
+@CompileStatic
+final class GormQuerySafetyWarnings {
+
+    private static final String GSTRING_VALUE_PLACEHOLDER = '${...}'
+    private static final Set<String> WARNED_GSTRING_QUERY_SHAPES = Collections.newSetFromMap(new ConcurrentHashMap<String, Boolean>())
+
+    private GormQuerySafetyWarnings() {
+    }
+
+    static boolean warnIfGStringQuery(Logger logger, CharSequence query, String operation) {
+        if (!(query instanceof GString) || ((GString) query).values.length == 0) {
+            return false
+        }
+
+        String queryShape = buildQueryShape((GString) query)
+        if (!logger.warnEnabled) {
+            return false
+        }
+
+        String warningKey = "${operation}\n${queryShape}"
+        if (!WARNED_GSTRING_QUERY_SHAPES.add(warningKey)) {
+            return false
+        }

Review Comment:
   WARNED_GSTRING_QUERY_SHAPES is an unbounded static set and `warnIfGStringQuery` builds `queryShape` even when warn logging is disabled. Over time (or in long-running processes), this can retain keys indefinitely and do unnecessary work on hot paths. Consider (a) checking `isWarnEnabled()` before building the shape/key and (b) adding a simple upper bound/eviction strategy for the warned-key set to avoid unbounded growth.



##########
grails-data-hibernate7/core/src/main/groovy/org/grails/orm/hibernate/HibernateGormStaticApi.groovy:
##########
@@ -480,6 +481,8 @@ class HibernateGormStaticApi<D> extends GormStaticApi<D> {
         if (hints.isEmpty() && querySettings != null) {
             hints = querySettings.findAll { AvailableHints.getDefinedHints().contains(it.key) }
         }
+        String operation = isNative ? 'native SQL query' : (isUpdate ? 'executeUpdate' : 'find/executeQuery')
+        GormQuerySafetyWarnings.warnIfGStringQuery(log, hql, operation)
         Map<String, Object> coercedParams = namedParams?.collectEntries { k, v -> [k.toString(), v] } ?: [:]
         def ctx = HqlQueryContext.prepare(persistentEntity, hql, coercedParams, positionalParams, querySettings, hints, isNative, isUpdate)

Review Comment:
   This change introduces new observable behavior (a one-time warning when a `GString` query is executed) but there is no test in the Hibernate GORM module asserting the warning is emitted once and does not include interpolated values. There are already `HibernateGormStaticApiSpec` tests executing a `GString` query (e.g. the injection-safe test) that could be extended to capture and assert the warning log output.



##########
grails-datamapping-core/src/main/groovy/org/grails/datastore/gorm/query/GormQuerySafetyWarnings.groovy:
##########
@@ -0,0 +1,67 @@
+/*
+ *  Licensed to the Apache Software Foundation (ASF) under one
+ *  or more contributor license agreements.  See the NOTICE file
+ *  distributed with this work for additional information
+ *  regarding copyright ownership.  The ASF licenses this file
+ *  to you under the Apache License, Version 2.0 (the
+ *  "License"); you may not use this file except in compliance
+ *  with the License.  You may obtain a copy of the License at
+ *
+ *    https://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing,
+ *  software distributed under the License is distributed on an
+ *  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ *  KIND, either express or implied.  See the License for the
+ *  specific language governing permissions and limitations
+ *  under the License.
+ */
+package org.grails.datastore.gorm.query
+
+import groovy.transform.CompileStatic
+
+import java.util.concurrent.ConcurrentHashMap
+
+import org.slf4j.Logger
+
+@CompileStatic
+final class GormQuerySafetyWarnings {
+
+    private static final String GSTRING_VALUE_PLACEHOLDER = '${...}'
+    private static final Set<String> WARNED_GSTRING_QUERY_SHAPES = Collections.newSetFromMap(new ConcurrentHashMap<String, Boolean>())
+
+    private GormQuerySafetyWarnings() {
+    }
+
+    static boolean warnIfGStringQuery(Logger logger, CharSequence query, String operation) {
+        if (!(query instanceof GString) || ((GString) query).values.length == 0) {
+            return false
+        }
+
+        String queryShape = buildQueryShape((GString) query)
+        if (!logger.warnEnabled) {
+            return false
+        }
+
+        String warningKey = "${operation}\n${queryShape}"
+        if (!WARNED_GSTRING_QUERY_SHAPES.add(warningKey)) {
+            return false
+        }
+
+        logger.warn('GString-interpolated HQL passed to [{}]. GORM binds interpolated values as query parameters, but explicit named parameters are recommended for query safety and readability. Query shape: [{}]', operation, queryShape)

Review Comment:
   The warning message hard-codes "HQL", but this helper is also invoked for `isNative` queries (native SQL) via `HibernateGormStaticApi`. Using a neutral term avoids a confusing/incorrect log message for native queries.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#issuecomment-4940140581

   ## [Codecov](https://app.codecov.io/gh/apache/grails-core/pull/15968?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
   :x: Patch coverage is `90.47619%` with `2 lines` in your changes missing coverage. Please review.
   :white_check_mark: Project coverage is 49.6216%. Comparing base ([`06f5567`](https://app.codecov.io/gh/apache/grails-core/commit/06f5567bf66040999d7617ef3111bc2ec796a737?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`8fdd94d`](https://app.codecov.io/gh/apache/grails-core/commit/8fdd94d3400abf0beccc67db128c91a066091d86?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
   
   | [Files with missing lines](https://app.codecov.io/gh/apache/grails-core/pull/15968?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
   |---|---|---|
   | [...atastore/gorm/query/GormQuerySafetyWarnings.groovy](https://app.codecov.io/gh/apache/grails-core/pull/15968?src=pr&el=tree&filepath=grails-datamapping-core%2Fsrc%2Fmain%2Fgroovy%2Forg%2Fgrails%2Fdatastore%2Fgorm%2Fquery%2FGormQuerySafetyWarnings.groovy&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Z3JhaWxzLWRhdGFtYXBwaW5nLWNvcmUvc3JjL21haW4vZ3Jvb3Z5L29yZy9ncmFpbHMvZGF0YXN0b3JlL2dvcm0vcXVlcnkvR29ybVF1ZXJ5U2FmZXR5V2FybmluZ3MuZ3Jvb3Z5) | 90.4762% | [2 Missing :warning: ](https://app.codecov.io/gh/apache/grails-core/pull/15968?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
   
   <details><summary>Additional details and impacted files</summary>
   
   
   
   [![Impacted file tree graph](https://app.codecov.io/gh/apache/grails-core/pull/15968/graphs/tree.svg?width=650&height=150&src=pr&token=qJrryhpk7u&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)](https://app.codecov.io/gh/apache/grails-core/pull/15968?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
   
   ```diff
   @@                Coverage Diff                 @@
   ##                8.0.x     #15968        +/-   ##
   ==================================================
   + Coverage     49.6039%   49.6216%   +0.0177%     
   - Complexity      16956      16973        +17     
   ==================================================
     Files            1999       2000         +1     
     Lines           93791      93812        +21     
     Branches        16421      16425         +4     
   ==================================================
   + Hits            46524      46551        +27     
   + Misses          40100      40094         -6     
     Partials         7167       7167                
   ```
   
   | [Files with missing lines](https://app.codecov.io/gh/apache/grails-core/pull/15968?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
   |---|---|---|
   | [...atastore/gorm/query/GormQuerySafetyWarnings.groovy](https://app.codecov.io/gh/apache/grails-core/pull/15968?src=pr&el=tree&filepath=grails-datamapping-core%2Fsrc%2Fmain%2Fgroovy%2Forg%2Fgrails%2Fdatastore%2Fgorm%2Fquery%2FGormQuerySafetyWarnings.groovy&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Z3JhaWxzLWRhdGFtYXBwaW5nLWNvcmUvc3JjL21haW4vZ3Jvb3Z5L29yZy9ncmFpbHMvZGF0YXN0b3JlL2dvcm0vcXVlcnkvR29ybVF1ZXJ5U2FmZXR5V2FybmluZ3MuZ3Jvb3Z5) | `90.4762% <90.4762%> (ø)` | |
   
   ... and [1 file with indirect coverage changes](https://app.codecov.io/gh/apache/grails-core/pull/15968/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
   </details>
   <details><summary> :rocket: New features to boost your workflow: </summary>
   
   - :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
   - :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "davydotcom (via GitHub)" <gi...@apache.org>.
davydotcom commented on PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#issuecomment-5007061707

   I think #15971 is a much better security approach on this one. The warning wont capture all cases and doesn't prevent it overall. The compile time transformation is a solid way to help reduce risk.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Warn once on GString-interpolated GORM HQL queries [grails-core]

Posted by "davydotcom (via GitHub)" <gi...@apache.org>.
davydotcom commented on PR #15968:
URL: https://github.com/apache/grails-core/pull/15968#issuecomment-5007065740

   closing for now, if we want to go this way, please do open it back up. just housekeeping @jamesfredley 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@grails.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org