fineract-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From rajuan <...@git.apache.org>
Subject [GitHub] incubator-fineract pull request #331: Adding validation to check not to have...
Date Fri, 21 Apr 2017 10:47:32 GMT
Github user rajuan commented on a diff in the pull request:

    https://github.com/apache/incubator-fineract/pull/331#discussion_r112662434
  
    --- Diff: fineract-provider/src/main/java/org/apache/fineract/portfolio/client/service/ClientReadPlatformServiceImpl.java
---
    @@ -225,6 +228,7 @@ private String buildSqlStringFromClientCriteria(final SearchParameters
searchPar
     
             String extraCriteria = "";
             if (sqlSearch != null) {
    +        	SQLInjectionValidator.validateSQLInput(sqlSearch);
    --- End diff --
    
    Instead of validating input param string.... I would suggest rewriting the query as prepared
statements..... Have a list to add/track a value when a sql is appended.....
    
    For eg.... replace extraCriteria.append(" and g.external_id = ").append(ApiParameterHelper.sqlEncodeString(externalId));
    
    with 
    extraCriteria.append(" and g.external_id = ? ")
    paramList.add(externalId)
    
    convert the paramList to array and use it in the jdbcTemplate in the end while executing
the query.....
    
    I'm not sure if this approach could be used for order by clause


---
If your project is set up for it, you can reply to this email and have your
reply appear on GitHub as well. If your project does not have this feature
enabled and wishes so, or if the feature is enabled but not working, please
contact infrastructure at infrastructure@apache.org or file a JIRA ticket
with INFRA.
---

Mime
View raw message