FINERACT-2181: modified inject-comment sql validation pattern to not match single dashes

fineract-provider/src/main/resources/application.properties

@@ -220,7 +220,7 @@ fineract.sql-validation.patterns[6].pattern=(?i).*[;]+\\s*(create|drop|alter|tru
 
 # inject-comment
 fineract.sql-validation.patterns[7].name=inject-comment
-fineract.sql-validation.patterns[7].pattern=(?i).*\\s+(-|/\\*|#|\\(\\{)++.*
+fineract.sql-validation.patterns[7].pattern=(?i).*\\s+(--|/\\*|#|\\(\\{)++.*
 
 # main
 fineract.sql-validation.profiles[0].name=main

fineract-provider/src/test/java/org/apache/fineract/infrastructure/dataqueries/service/SqlValidatorTest.java

@@ -0,0 +1,48 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.dataqueries.service;
+
+import org.apache.fineract.TestConfiguration;
+import org.apache.fineract.infrastructure.security.exception.SqlValidationException;
+import org.apache.fineract.infrastructure.security.service.SqlValidator;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.test.context.SpringBootTest;
+import org.springframework.test.context.ContextConfiguration;
+
+@SpringBootTest
+@ContextConfiguration(classes = TestConfiguration.class)
+public class SqlValidatorTest {
+
+    @Autowired
+    private SqlValidator sqlValidator;
+
+    @Test
+    public void testSingleDashInParameterName() {
+        final String paramToValidate = "Loan Report - Active";
+        Assertions.assertDoesNotThrow(() -> sqlValidator.validate(paramToValidate));
+    }
+
+    @Test
+    public void testCommentInjectionAttempt() {
+        final String paramToValidate = "Loan Report -- Active";
+        Assertions.assertThrows(SqlValidationException.class, () -> sqlValidator.validate(paramToValidate));
+    }
+}

fineract-provider/src/test/resources/application-test.properties

@@ -137,7 +137,7 @@ fineract.sql-validation.patterns[6].pattern=(?i).*[;]+\\s*(create|drop|alter|tru
 
 # inject-comment
 fineract.sql-validation.patterns[7].name=inject-comment
-fineract.sql-validation.patterns[7].pattern=(?i).*\\s+(-|/\\*|#|\\(\\{)++.*
+fineract.sql-validation.patterns[7].pattern=(?i).*\\s+(--|/\\*|#|\\(\\{)++.*
 
 # main
 fineract.sql-validation.profiles[0].name=main