From b107acb005f2c77e488d27149cdb800da40495bc Mon Sep 17 00:00:00 2001 From: saifulhuq01 Date: Fri, 30 Jan 2026 09:50:22 +0530 Subject: [PATCH] FINERACT-2459: Refactor SmsReadPlatformServiceImpl to use Prepared Statements --- .../sms/service/SmsReadPlatformServiceImpl.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/sms/service/SmsReadPlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/sms/service/SmsReadPlatformServiceImpl.java index 56634ce0d..eb1c4a816 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/sms/service/SmsReadPlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/sms/service/SmsReadPlatformServiceImpl.java @@ -22,6 +22,7 @@ import jakarta.annotation.PostConstruct; import java.sql.ResultSet; import java.sql.SQLException; import java.time.LocalDate; +import java.util.ArrayList; import java.util.Arrays; import java.util.List; import lombok.RequiredArgsConstructor; @@ -131,14 +132,18 @@ public class SmsReadPlatformServiceImpl implements SmsReadPlatformService { @Override public List retrieveAllPending(final Long campaignId, final Integer limit) { final String sqlPlusLimit = limit > 0 ? " " + sqlGenerator.limit(limit) : ""; - String sql = "select " + this.smsRowMapper.schema() + " where smo.status_enum = " + SmsMessageStatusType.PENDING.getValue(); + String sql = "select " + this.smsRowMapper.schema() + " where smo.status_enum = ?"; + List params = new ArrayList<>(); + params.add(SmsMessageStatusType.PENDING.getValue()); + if (campaignId != null) { - sql += " and smo.campaign_id = " + campaignId; + sql += " and smo.campaign_id = ?"; + params.add(campaignId); } sql += sqlPlusLimit; - return this.jdbcTemplate.query(sql, this.smsRowMapper); // NOSONAR + return this.jdbcTemplate.query(sql, this.smsRowMapper, params.toArray()); // NOSONAR } @Override