FINERACT-1724: Datatables query API fix - invalid tablename

This commit is contained in:
abraham.menyhart
2023-06-06 14:09:29 +02:00
committed by Adam Saghy
parent d87d483665
commit 500e7720b7
2 changed files with 24 additions and 0 deletions
@@ -196,6 +196,7 @@ public class ReadWriteNonCoreDataServiceImpl implements ReadWriteNonCoreDataServ
@Override
public List<JsonObject> queryDataTable(String datatable, final String columnFilter, String valueFilter, String resultColumns) {
asList(datatable, columnFilter, valueFilter, resultColumns).forEach(SQLInjectionValidator::validateDynamicQuery);
validateDatatable(datatable);
List<ResultsetColumnHeaderData> resultsetColumnHeaderData = genericDataService.fillResultsetColumnHeaders(datatable);
validateRequestParams(columnFilter, valueFilter, resultColumns, resultsetColumnHeaderData);
@@ -1859,6 +1860,14 @@ public class ReadWriteNonCoreDataServiceImpl implements ReadWriteNonCoreDataServ
return applicationTableName;
}
private void validateDatatable(final String datatable) {
final String sql = "SELECT COUNT(application_table_name) FROM x_registered_table WHERE registered_table_name = ?";
final Integer count = jdbcTemplate.queryForObject(sql, Integer.class, datatable);
if (count == 0) {
throw new DatatableNotFoundException(datatable);
}
}
private String getFKField(final String applicationTableName) {
return applicationTableName.substring(2) + "_id";
}