jinggou commented on code in PR #9:
URL: https://github.com/apache/phoenix-adapters/pull/9#discussion_r3439037879
##########
phoenix-ddb-rest/src/main/java/org/apache/phoenix/ddb/service/QueryService.java:
##########
@@ -184,24 +184,46 @@ private static void
setPreparedStatementValues(PreparedStatement stmt,
(Map<String, Object>)
request.get(ApiMetadata.EXPRESSION_ATTRIBUTE_VALUES);
// Bind partition key value
+ String partitionValuePlaceholder = keyConditions.getPartitionValue();
+ if (!exprAttrVals.containsKey(partitionValuePlaceholder)) {
+ throw new ValidationException(String.format(
+ "ExpressionAttributeValues missing required placeholder
'%s' for partition key",
+ partitionValuePlaceholder));
+ }
Map<String, Object> partitionAttrVal =
- (Map<String, Object>)
exprAttrVals.get(keyConditions.getPartitionValue());
+ (Map<String, Object>)
exprAttrVals.get(partitionValuePlaceholder);
DQLUtils.setKeyValueOnStatement(stmt, index++, partitionAttrVal,
false);
// Bind sort key values from key condition expression
if (keyConditions.hasSortKey()) {
if (keyConditions.hasBeginsWith()) {
- Map<String, Object> sortAttrVal = (Map<String, Object>)
exprAttrVals.get(
- keyConditions.getBeginsWithSortKeyVal());
+ String beginsWithPlaceholder =
keyConditions.getBeginsWithSortKeyVal();
+ if (!exprAttrVals.containsKey(beginsWithPlaceholder)) {
+ throw new ValidationException(String.format(
+ "ExpressionAttributeValues missing required
placeholder '%s' for sort key begins_with condition",
+ beginsWithPlaceholder));
+ }
+ Map<String, Object> sortAttrVal = (Map<String, Object>)
exprAttrVals.get(beginsWithPlaceholder);
DQLUtils.setKeyValueOnStatement(stmt, index++, sortAttrVal,
true);
Review Comment:
DQLUtils.setKeyValueOnStatement is called from:
QueryService (ExpressionAttributeValues) ← needs validation
ScanService pagination (ExclusiveStartKey) ← no validation needed
BatchGetItemService (direct Key values) ← no validation needed
GetItemService (direct Key values) ← no validation needed
Adding validation inside setKeyValueOnStatement() would incorrectly fail
legitimate uses. Instead, centralized in ValidationUtil for
ExpressionAttributeValues-specific validation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
