CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

FINERACT-1969 SQL Injection exception thrown even if no insecure string is in the input

Browse Source
This commit is contained in:
jmarta
2023-08-31 17:31:16 +02:00
committed by Adam Saghy
parent 28e9a62137
commit 6a90ce3f10
17 changed files with 636 additions and 906 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/api/DatatablesApiResource.java
+6 -8
View File
@@ -314,7 +314,7 @@ public class DatatablesApiResource {
@Parameter(hidden = true) final String apiRequestBodyAsJson) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.createDatatable(datatable, apptableId, null) //
.createDatatableEntry(datatable, apptableId, null) //
.withJson(apiRequestBodyAsJson) //
.build();
@@ -336,7 +336,7 @@ public class DatatablesApiResource {
@Parameter(hidden = true) final String apiRequestBodyAsJson) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.updateDatatable(datatable, apptableId, null) //
.updateDatatableEntry(datatable, apptableId, null) //
.withJson(apiRequestBodyAsJson) //
.build();
@@ -359,7 +359,7 @@ public class DatatablesApiResource {
@Parameter(hidden = true) final String apiRequestBodyAsJson) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.updateDatatable(datatable, apptableId, datatableId) //
.updateDatatableEntry(datatable, apptableId, datatableId) //
.withJson(apiRequestBodyAsJson) //
.build();
@@ -380,7 +380,7 @@ public class DatatablesApiResource {
@PathParam("apptableId") @Parameter(description = "apptableId") final Long apptableId) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.deleteDatatable(datatable, apptableId, null) //
.deleteDatatableEntry(datatable, apptableId, null) //
.build();
final CommandProcessingResult result = this.commandsSourceWritePlatformService.logCommandSource(commandRequest);
@@ -396,13 +396,11 @@ public class DatatablesApiResource {
+ "\n")
@ApiResponses({
@ApiResponse(responseCode = "200", description = "OK", content = @Content(schema = @Schema(implementation = DatatablesApiResourceSwagger.DeleteDataTablesDatatableAppTableIdDatatableIdResponse.class))) })
public String deleteDatatableEntries(
@PathParam("datatable") @Parameter(description = "datatable", example = "{}") final String datatable,
public String deleteDatatableEntry(@PathParam("datatable") @Parameter(description = "datatable", example = "{}") final String datatable,
@PathParam("apptableId") @Parameter(description = "apptableId") final Long apptableId,
@PathParam("datatableId") @Parameter(description = "datatableId") final Long datatableId) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.deleteDatatable(datatable, apptableId, datatableId) //
.deleteDatatableEntry(datatable, apptableId, datatableId) //
.build();
final CommandProcessingResult result = this.commandsSourceWritePlatformService.logCommandSource(commandRequest);
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/handler/DeleteOneToManyDatatableEntryCommandHandler.java
+1 -14
View File
@@ -21,7 +21,6 @@ package org.apache.fineract.infrastructure.dataqueries.handler;
import org.apache.fineract.commands.handler.NewCommandSourceHandler;
import org.apache.fineract.infrastructure.core.api.JsonCommand;
import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
import org.apache.fineract.infrastructure.dataqueries.service.ReadWriteNonCoreDataService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@@ -40,18 +39,6 @@ public class DeleteOneToManyDatatableEntryCommandHandler implements NewCommandSo
@Transactional
@Override
public CommandProcessingResult processCommand(final JsonCommand command) {
final CommandProcessingResult commandProcessingResult = this.writePlatformService.deleteDatatableEntry(command.entityName(),
command.entityId(), command.subentityId());
return new CommandProcessingResultBuilder() //
.withCommandId(command.commandId()) //
.withEntityId(command.entityId()) //
.withOfficeId(commandProcessingResult.getOfficeId()) //
.withGroupId(commandProcessingResult.getGroupId()) //
.withClientId(commandProcessingResult.getClientId()) //
.withSavingsId(commandProcessingResult.getSavingsId()) //
.withLoanId(commandProcessingResult.getLoanId()) //
.build();
return this.writePlatformService.deleteDatatableEntry(command.entityName(), command.entityId(), command.subentityId(), command);
}
}
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/handler/DeleteOneToOneDatatableEntryCommandHandler.java
+1 -14
View File
@@ -21,7 +21,6 @@ package org.apache.fineract.infrastructure.dataqueries.handler;
import org.apache.fineract.commands.handler.NewCommandSourceHandler;
import org.apache.fineract.infrastructure.core.api.JsonCommand;
import org.apache.fineract.infrastructure.core.data.CommandProcessingResult;
import org.apache.fineract.infrastructure.core.data.CommandProcessingResultBuilder;
import org.apache.fineract.infrastructure.dataqueries.service.ReadWriteNonCoreDataService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@@ -40,18 +39,6 @@ public class DeleteOneToOneDatatableEntryCommandHandler implements NewCommandSou
@Transactional
@Override
public CommandProcessingResult processCommand(final JsonCommand command) {
final CommandProcessingResult commandProcessingResult = this.writePlatformService.deleteDatatableEntries(command.entityName(),
command.entityId());
return new CommandProcessingResultBuilder() //
.withCommandId(command.commandId()) //
.withEntityId(command.entityId()) //
.withOfficeId(commandProcessingResult.getOfficeId()) //
.withGroupId(commandProcessingResult.getGroupId()) //
.withClientId(commandProcessingResult.getClientId()) //
.withSavingsId(commandProcessingResult.getSavingsId()) //
.withLoanId(commandProcessingResult.getLoanId()) //
.build();
return this.writePlatformService.deleteDatatableEntries(command.entityName(), command.entityId(), command);
}
}
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/EntityDatatableChecksWritePlatformServiceImpl.java
-1
View File
@@ -272,5 +272,4 @@ public class EntityDatatableChecksWritePlatformServiceImpl implements EntityData
throw new PlatformDataIntegrityException("error.msg.report.unknown.data.integrity.issue",
"Unknown data integrity issue with resource: " + realCause.getMessage());
}
}
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/ReadWriteNonCoreDataService.java
+2 -2
View File
@@ -68,9 +68,9 @@ public interface ReadWriteNonCoreDataService {
CommandProcessingResult updateDatatableEntryOneToMany(String datatable, Long appTableId, Long datatableId, JsonCommand command);
CommandProcessingResult deleteDatatableEntries(String datatable, Long appTableId);
CommandProcessingResult deleteDatatableEntries(String datatable, Long appTableId, JsonCommand command);
CommandProcessingResult deleteDatatableEntry(String datatable, Long appTableId, Long datatableId);
CommandProcessingResult deleteDatatableEntry(String datatable, Long appTableId, Long datatableId, JsonCommand command);
String getTableName(String Url);
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/ReadWriteNonCoreDataServiceImpl.java
+572 -842
View File
File diff suppressed because it is too large Load Diff
fineract-provider/src/main/java/org/apache/fineract/infrastructure/survey/api/SurveyApiResource.java
+1 -1
View File
@@ -174,7 +174,7 @@ public class SurveyApiResource {
@PathParam("fulfilledId") final Long fulfilledId) {
final CommandWrapper commandRequest = new CommandWrapperBuilder() //
.deleteDatatable(surveyName, clientId, fulfilledId) //
.deleteDatatableEntry(surveyName, clientId, fulfilledId) //
.build();
final CommandProcessingResult result = this.commandsSourceWritePlatformService.logCommandSource(commandRequest);
fineract-provider/src/main/java/org/apache/fineract/portfolio/search/SearchConstants.java
+3
View File
@@ -31,6 +31,9 @@ public final class SearchConstants {
public static final String API_PARAM_VALUES = "values";
public static final String API_PARAM_TABLE = "table";
public static final String API_PARAM_QUERY = "query";
public static final String API_PARAM_DATE_FORMAT = "dateFormat";
public static final String API_PARAM_DATETIME_FORMAT = "dateTimeFormat";
public static final String API_PARAM_LOCALE = "locale";
private SearchConstants() {}
fineract-provider/src/main/java/org/apache/fineract/portfolio/search/service/SearchUtil.java
+1 -2
View File
@@ -86,8 +86,7 @@ public final class SearchUtil {
@NotNull List<String> resultColumns, @NotNull List<JsonObject> results) {
JsonObject json = new JsonObject();
for (int i = 0; i < selectColumns.size(); i++) {
String sCol = selectColumns.get(i).replaceAll("\"", "");
Object rowValue = rowSet.getObject(sCol);
Object rowValue = rowSet.getObject(selectColumns.get(i));
if (rowValue != null) {
String rCol = resultColumns.get(i);
if (rowValue instanceof Character) {