This is an automated email from the ASF dual-hosted git repository.
jungm pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/tomee.git
The following commit(s) were added to refs/heads/main by this push:
new 6f18e1a687 restrict dynamic sort properties to attribute paths
6f18e1a687 is described below
commit 6f18e1a6879d02ba60e77add72355c1c1b4f505c
Author: Markus Jung <[email protected]>
AuthorDate: Sun Aug 23 21:03:23 2026 +0200
restrict dynamic sort properties to attribute paths
---
.../openejb/data/query/CriteriaQueryBuilder.java | 23 +++++++-
.../data/query/SortPropertyValidationTest.java | 63 ++++++++++++++++++++++
.../apache/openejb/data/test/SortAndLimitTest.java | 23 ++++++++
3 files changed, 107 insertions(+), 2 deletions(-)
diff --git
a/container/openejb-jakarta-data/src/main/java/org/apache/openejb/data/query/CriteriaQueryBuilder.java
b/container/openejb-jakarta-data/src/main/java/org/apache/openejb/data/query/CriteriaQueryBuilder.java
index 85b911f803..d0635096c9 100644
---
a/container/openejb-jakarta-data/src/main/java/org/apache/openejb/data/query/CriteriaQueryBuilder.java
+++
b/container/openejb-jakarta-data/src/main/java/org/apache/openejb/data/query/CriteriaQueryBuilder.java
@@ -23,9 +23,17 @@ import jakarta.persistence.EntityManager;
import jakarta.persistence.TypedQuery;
import java.util.List;
+import java.util.regex.Pattern;
public final class CriteriaQueryBuilder {
+ /**
+ * A dynamic sort property is limited to an attribute name or a dotted
+ * attribute path, e.g. {@code priority} or {@code address.city}.
+ */
+ private static final Pattern VALID_SORT_PROPERTY =
+
Pattern.compile("[A-Za-z_$][A-Za-z0-9_$]*(\\.[A-Za-z_$][A-Za-z0-9_$]*)*");
+
private CriteriaQueryBuilder() {
}
@@ -193,11 +201,11 @@ public final class CriteriaQueryBuilder {
final List<String> sortClauses = new java.util.ArrayList<>();
for (final Object arg : args) {
if (arg instanceof Sort<?> sort) {
- sortClauses.add("e." + sort.property() + (sort.isAscending() ?
" ASC" : " DESC"));
+ sortClauses.add("e." + validateSortProperty(sort.property()) +
(sort.isAscending() ? " ASC" : " DESC"));
} else if (arg instanceof jakarta.data.Order<?> order) {
for (final Object s : order.sorts()) {
final Sort<?> sort = (Sort<?>) s;
- sortClauses.add("e." + sort.property() +
(sort.isAscending() ? " ASC" : " DESC"));
+ sortClauses.add("e." +
validateSortProperty(sort.property()) + (sort.isAscending() ? " ASC" : "
DESC"));
}
}
}
@@ -216,6 +224,17 @@ public final class CriteriaQueryBuilder {
return baseJpql + " ORDER BY " + String.join(", ", sortClauses);
}
+ /**
+ * Returns the property if it is a plain attribute name or a dotted
attribute
+ * path, otherwise throws {@link IllegalArgumentException}.
+ */
+ static String validateSortProperty(final String property) {
+ if (property == null ||
!VALID_SORT_PROPERTY.matcher(property).matches()) {
+ throw new IllegalArgumentException("Invalid sort property: " +
property);
+ }
+ return property;
+ }
+
static boolean isSpecialParameter(final Class<?> type) {
return jakarta.data.Limit.class.isAssignableFrom(type)
|| jakarta.data.Sort.class.isAssignableFrom(type)
diff --git
a/container/openejb-jakarta-data/src/test/java/org/apache/openejb/data/query/SortPropertyValidationTest.java
b/container/openejb-jakarta-data/src/test/java/org/apache/openejb/data/query/SortPropertyValidationTest.java
new file mode 100644
index 0000000000..dfca908315
--- /dev/null
+++
b/container/openejb-jakarta-data/src/test/java/org/apache/openejb/data/query/SortPropertyValidationTest.java
@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.openejb.data.query;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+class SortPropertyValidationTest {
+
+ @Test
+ void acceptsSimpleAttributeNames() {
+ assertEquals("name",
CriteriaQueryBuilder.validateSortProperty("name"));
+ assertEquals("priority",
CriteriaQueryBuilder.validateSortProperty("priority"));
+ assertEquals("_internal$Field2",
CriteriaQueryBuilder.validateSortProperty("_internal$Field2"));
+ }
+
+ @Test
+ void acceptsDottedAttributePaths() {
+ assertEquals("address.city",
CriteriaQueryBuilder.validateSortProperty("address.city"));
+ assertEquals("owner.address.zipCode",
CriteriaQueryBuilder.validateSortProperty("owner.address.zipCode"));
+ }
+
+ @Test
+ void rejectsNull() {
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty(null));
+ }
+
+ @Test
+ void rejectsEmptyAndMalformedPaths() {
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty(""));
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty(".name"));
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty("name."));
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty("a..b"));
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty("1name"));
+ }
+
+ @Test
+ void rejectsPropertiesContainingExpressions() {
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty(
+ "(SELECT u.password FROM Users u WHERE u.admin = TRUE)"));
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty(
+ "name, (CASE WHEN (SELECT COUNT(u) FROM Users u) > 0 THEN 1 ELSE 2
END)"));
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty("name ASC, e.secret"));
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty("name'"));
+ assertThrows(IllegalArgumentException.class, () ->
CriteriaQueryBuilder.validateSortProperty("name "));
+ }
+}
diff --git
a/container/openejb-jakarta-data/src/test/java/org/apache/openejb/data/test/SortAndLimitTest.java
b/container/openejb-jakarta-data/src/test/java/org/apache/openejb/data/test/SortAndLimitTest.java
index 2a52ffb282..5184858bf9 100644
---
a/container/openejb-jakarta-data/src/test/java/org/apache/openejb/data/test/SortAndLimitTest.java
+++
b/container/openejb-jakarta-data/src/test/java/org/apache/openejb/data/test/SortAndLimitTest.java
@@ -43,6 +43,7 @@ import java.util.Properties;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNotNull;
import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
@RunWith(ApplicationComposer.class)
public class SortAndLimitTest {
@@ -160,6 +161,28 @@ public class SortAndLimitTest {
}
}
+ @Test
+ public void testSortPropertyMustBeAttributePath() throws Exception {
+ try {
+ repo.findByCompletedFalse(Sort.asc("priority ASC, e.title"));
+ fail("expected IllegalArgumentException");
+ } catch (final IllegalArgumentException expected) {
+ assertTrue(expected.getMessage().contains("Invalid sort
property"));
+ }
+ }
+
+ @Test
+ public void testOrderSortPropertyMustBeAttributePath() throws Exception {
+ @SuppressWarnings("unchecked")
+ final Order<Task> order = Order.by(Sort.asc("(SELECT t.title FROM Task
t)"));
+ try {
+ repo.findByCompletedFalse(order);
+ fail("expected IllegalArgumentException");
+ } catch (final IllegalArgumentException expected) {
+ assertTrue(expected.getMessage().contains("Invalid sort
property"));
+ }
+ }
+
// -- Order tests --
@Test
