From 237c0c12931bf186880f1254afdb710fd6134bf9 Mon Sep 17 00:00:00 2001 From: Joseph Makara Date: Sat, 27 Mar 2021 18:54:53 +0300 Subject: [PATCH] Use prepared statements instead of string concatenated SQL everywhere - WIP (FINERACT-854) --- .../service/GenericDataServiceImpl.java | 23 +++++++++++-------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/GenericDataServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/GenericDataServiceImpl.java index 078d3d3e0..8c11f880e 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/GenericDataServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/GenericDataServiceImpl.java @@ -261,9 +261,9 @@ public class GenericDataServiceImpl implements GenericDataService { final List columnValues = new ArrayList<>(); final String sql = "select v.id, v.code_score, v.code_value from m_code m " + " join m_code_value v on v.code_id = m.id " - + " where m.code_name = ? order by v.order_position, v.id"; + + " where m.code_name = '" + codeName + "' order by v.order_position, v.id"; - final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql, String.class, new Object[] { codeName }); + final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql); rsValues.beforeFirst(); while (rsValues.next()) { @@ -281,8 +281,9 @@ public class GenericDataServiceImpl implements GenericDataService { final List columnValues = new ArrayList<>(); if (codeId != null) { - final String sql = "select v.id, v.code_value from m_code_value v where v.code_id =? order by v.order_position, v.id"; - final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql, Integer.class, new Object[] { codeId }); + final String sql = "select v.id, v.code_value from m_code_value v where v.code_id =" + codeId + + " order by v.order_position, v.id"; + final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql); rsValues.beforeFirst(); while (rsValues.next()) { final Integer id = rsValues.getInt("id"); @@ -297,9 +298,10 @@ public class GenericDataServiceImpl implements GenericDataService { private SqlRowSet getDatatableMetaData(final String datatable) { final String sql = "select COLUMN_NAME, IS_NULLABLE, DATA_TYPE, CHARACTER_MAXIMUM_LENGTH, COLUMN_KEY" - + " from INFORMATION_SCHEMA.COLUMNS " + " where TABLE_SCHEMA = schema() and TABLE_NAME = ? order by ORDINAL_POSITION"; + + " from INFORMATION_SCHEMA.COLUMNS " + " where TABLE_SCHEMA = schema() and TABLE_NAME = '" + datatable + + "'order by ORDINAL_POSITION"; - final SqlRowSet columnDefinitions = this.jdbcTemplate.queryForRowSet(sql, String.class, new Object[] { datatable }); + final SqlRowSet columnDefinitions = this.jdbcTemplate.queryForRowSet(sql); if (columnDefinitions.next()) { return columnDefinitions; } @@ -307,10 +309,11 @@ public class GenericDataServiceImpl implements GenericDataService { throw new DatatableNotFoundException(datatable); } - private SqlRowSet getDatatableCodeData(final String aDatatable, final String aColumnName) { - String datatableColumnName = aDatatable.toLowerCase().replaceAll("\\s", "_") + "_" + aColumnName; - final String sql = "select mc.id,mc.code_name from m_code mc join x_table_column_code_mappings xcc on xcc.code_id = mc.id where xcc.column_alias_name=?"; - final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql, String.class, new Object[] { datatableColumnName }); + private SqlRowSet getDatatableCodeData(final String datatable, final String columnName) { + + final String sql = "select mc.id,mc.code_name from m_code mc join x_table_column_code_mappings xcc on xcc.code_id = mc.id where xcc.column_alias_name='" + + datatable.toLowerCase().replaceAll("\\s", "_") + "_" + columnName + "'"; + final SqlRowSet rsValues = this.jdbcTemplate.queryForRowSet(sql); return rsValues; }