[jira] [Commented] (PHOENIX-6560) Rewrite dynamic SQL queries to use Preparedstatement

["ASF GitHub Bot (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/PHOENIX-6560?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17718797#comment-17718797 ] 

ASF GitHub Bot commented on PHOENIX-6560:
-----------------------------------------

stoty commented on PR #1586:
URL: https://github.com/apache/phoenix/pull/1586#issuecomment-1532483494

   started a new ci build, as the results have aged out.




> Rewrite dynamic SQL queries to use Preparedstatement
> ----------------------------------------------------
>
>                 Key: PHOENIX-6560
>                 URL: https://issues.apache.org/jira/browse/PHOENIX-6560
>             Project: Phoenix
>          Issue Type: Improvement
>          Components: core
>            Reporter: Istvan Toth
>            Assignee: Abhishek Kothalikar
>            Priority: Major
>
> Most of the Phoenix code base already uses PreparedStatements, and adds all potentially vulnerable data as parameters.
> However, there are some places where we concatenate potentially problematic strings into the query.
> While most of those are constants and such, we should preferably pass all data as parameters to be on the safe side.
> (We still have to use dynamic strings for the preparedstatement strings, for handling things as is null, empty in clauses and such)
> Spotbugs marks these with SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE, so they're easy to find.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)