CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 28 Packages Projects Releases Wiki Activity

FINERACT-1757: Uppercase letters in the datatable name is failing on postgres

Browse Source
This commit is contained in:
Jose Alberto Hernandez
2023-04-26 17:56:00 +02:00
committed by Adam Saghy
parent 5f713be7ec
commit 6f2b0198a2
4 changed files with 132 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/java/org/apache/fineract/infrastructure/dataqueries/service/ReadWriteNonCoreDataServiceImpl.java
+19 -3
View File
@@ -204,17 +204,19 @@ public class ReadWriteNonCoreDataServiceImpl implements ReadWriteNonCoreDataServ
}
@Override
public List<JsonObject> queryDataTable(String datatable, String columnFilter, String valueFilter, String resultColumns) {
public List<JsonObject> queryDataTable(String datatable, final String columnFilter, String valueFilter, String resultColumns) {
Arrays.asList(datatable, columnFilter, valueFilter, resultColumns).forEach(SQLInjectionValidator::validateDynamicQuery);
List<ResultsetColumnHeaderData> resultsetColumnHeaderData = genericDataService.fillResultsetColumnHeaders(datatable);
validateRequestParams(columnFilter, valueFilter, resultColumns, resultsetColumnHeaderData);
String filterColumnType = resultsetColumnHeaderData.stream().filter(column -> Objects.equals(columnFilter, column.getColumnName()))
.findFirst().map(ResultsetColumnHeaderData::getColumnType).orElse(columnFilter + " does not exist in datatable");
String sql = "select " + resultColumns + " from " + datatable + " where " + columnFilter + " = ?";
SqlRowSet rowSet = null;
String filterColumnType = resultsetColumnHeaderData.stream().filter(column -> Objects.equals(columnFilter, column.getColumnName()))
.findFirst().map(ResultsetColumnHeaderData::getColumnType).orElse(columnFilter + " does not exist in datatable");
if (databaseTypeResolver.isPostgreSQL()) {
sql = "select " + escapeFieldNames(resultColumns) + " from " + sqlGenerator.escape(datatable) + " where "
+ escapeFieldNames(columnFilter) + " = ?";
rowSet = callFilteredPgSql(sql, valueFilter, filterColumnType);
} else if (databaseTypeResolver.isMySQL()) {
rowSet = callFilteredMysql(sql, valueFilter, filterColumnType);
@@ -234,6 +236,7 @@ public class ReadWriteNonCoreDataServiceImpl implements ReadWriteNonCoreDataServ
private void extractResults(SqlRowSet rowSet, String[] resultColumnNames, List<JsonObject> results) {
JsonObject json = new JsonObject();
for (String rcn : resultColumnNames) {
rcn = rcn.replaceAll("\"", "");
Object rowValue = rowSet.getObject(rcn);
if (rowValue != null) {
if (rowValue instanceof Character) {
@@ -332,6 +335,19 @@ public class ReadWriteNonCoreDataServiceImpl implements ReadWriteNonCoreDataServ
return jdbcTemplate.queryForRowSet(sql, new Object[] { finalValueFilter }, argType);
}
private String escapeFieldNames(final String inputFields) {
final String delimiter = ",";
if (StringUtils.isBlank(inputFields)) {
return inputFields;
}
final String[] fieldList = StringUtils.split(inputFields, delimiter);
final String[] outputFields = new String[fieldList.length];
for (int i = 0; i < fieldList.length; i++) {
outputFields[i] = sqlGenerator.escape(fieldList[i].trim());
}
return String.join(",", outputFields);
}
private static void validateRequestParams(String columnFilter, String valueFilter, String resultColumns,
List<ResultsetColumnHeaderData> resultsetColumnHeaderData) {
List<ApiParameterError> paramErrors = new ArrayList<>();