jamesfredley opened a new pull request, #16333: URL: https://github.com/apache/grails-core/pull/16333
> Same-repo continuation of #16312. Head is `apache/grails-core:fix/dynamic-finder-sort-validation` (includes jdaugherty's follow-up). The previous PR used the archive fork as head, which is not allowed. ## Summary ASF security review follow-up: validate sort names in `DynamicFinder` and the Hibernate HQL list builder. `Book.list(sort: params.sort)` and `HqlListQueryBuilder` interpolated the sort key into query / HQL order-by clauses. A client-supplied value such as `name, e.id` or a non-property token was not checked against the persistent mapping. This is hardening, not an advisory, unless the threat model is expanded. Apps that concatenate HQL themselves remain out of scope. ## Changes - `DynamicFinder` rejects sort keys that are not identifier-shaped property paths, and when a mapping is available, keys that do not resolve to a persistent property (including nested associations and identity). - `HqlListQueryBuilder` applies the same property-path check, requires the property to exist on the Hibernate mapping, and only allows `asc` / `desc`. ## Testing - `:grails-datamapping-core:test` - `:grails-data-hibernate7-core:test --tests org.grails.orm.hibernate.query.HqlListQueryBuilderSpec` - codeStyle on those modules -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
