From 531bd1002a480728936f8fa29ce87d4418783878 Mon Sep 17 00:00:00 2001 From: danielhanrahan Date: Fri, 23 Jun 2023 12:49:27 +0100 Subject: Escape SQL LIKE wildcards in queries (CPS-1760 #1) If '%' and '_' are used in the contains-condition of a CpsPath query, incorrect results will be returned. For example: /bookstore/categories[contains(@code, "%")] Special characters in the contains-condition value must be escaped. Issue-ID: CPS-1762 Signed-off-by: danielhanrahan Change-Id: I2fdd5a26433d510cd7d6af5b734a6779b537d63d --- .../cps/spi/repository/FragmentQueryBuilder.java | 4 ++- .../cps/spi/repository/FragmentRepository.java | 7 ++--- .../java/org/onap/cps/spi/utils/EscapeUtils.java | 33 ++++++++++++++++++++ .../org/onap/cps/spi/utils/EscapeUtilsSpec.groovy | 36 ++++++++++++++++++++++ 4 files changed, 75 insertions(+), 5 deletions(-) create mode 100644 cps-ri/src/main/java/org/onap/cps/spi/utils/EscapeUtils.java create mode 100644 cps-ri/src/test/groovy/org/onap/cps/spi/utils/EscapeUtilsSpec.groovy (limited to 'cps-ri/src') diff --git a/cps-ri/src/main/java/org/onap/cps/spi/repository/FragmentQueryBuilder.java b/cps-ri/src/main/java/org/onap/cps/spi/repository/FragmentQueryBuilder.java index ba94d56b1c..34dea9bc19 100644 --- a/cps-ri/src/main/java/org/onap/cps/spi/repository/FragmentQueryBuilder.java +++ b/cps-ri/src/main/java/org/onap/cps/spi/repository/FragmentQueryBuilder.java @@ -36,6 +36,7 @@ import org.onap.cps.spi.entities.AnchorEntity; import org.onap.cps.spi.entities.DataspaceEntity; import org.onap.cps.spi.entities.FragmentEntity; import org.onap.cps.spi.exceptions.CpsPathException; +import org.onap.cps.spi.utils.EscapeUtils; import org.onap.cps.utils.JsonObjectMapper; import org.springframework.stereotype.Component; @@ -202,7 +203,8 @@ public class FragmentQueryBuilder { if (cpsPathQuery.hasContainsFunctionCondition()) { sqlStringBuilder.append(" AND attributes ->> :containsLeafName LIKE CONCAT('%',:containsValue,'%') "); queryParameters.put("containsLeafName", cpsPathQuery.getContainsFunctionConditionLeafName()); - queryParameters.put("containsValue", cpsPathQuery.getContainsFunctionConditionValue()); + queryParameters.put("containsValue", + EscapeUtils.escapeForSqlLike(cpsPathQuery.getContainsFunctionConditionValue())); } } diff --git a/cps-ri/src/main/java/org/onap/cps/spi/repository/FragmentRepository.java b/cps-ri/src/main/java/org/onap/cps/spi/repository/FragmentRepository.java index 03de95eb8d..303af5bc47 100755 --- a/cps-ri/src/main/java/org/onap/cps/spi/repository/FragmentRepository.java +++ b/cps-ri/src/main/java/org/onap/cps/spi/repository/FragmentRepository.java @@ -30,6 +30,7 @@ import org.onap.cps.spi.entities.AnchorEntity; import org.onap.cps.spi.entities.DataspaceEntity; import org.onap.cps.spi.entities.FragmentEntity; import org.onap.cps.spi.exceptions.DataNodeNotFoundException; +import org.onap.cps.spi.utils.EscapeUtils; import org.springframework.data.jpa.repository.JpaRepository; import org.springframework.data.jpa.repository.Modifying; import org.springframework.data.jpa.repository.Query; @@ -67,8 +68,6 @@ public interface FragmentRepository extends JpaRepository, return findByDataspaceIdAndXpathIn(dataspaceEntity.getId(), xpaths.toArray(new String[0])); } - boolean existsByAnchorId(long anchorId); - @Query(value = "SELECT * FROM fragment WHERE anchor_id = :anchorId LIMIT 1", nativeQuery = true) Optional findOneByAnchorId(@Param("anchorId") long anchorId); @@ -95,8 +94,8 @@ public interface FragmentRepository extends JpaRepository, @Param("xpathPatterns") String[] xpathPatterns); default void deleteListsByAnchorIdAndXpaths(long anchorId, Collection xpaths) { - final String[] listXpathPatterns = xpaths.stream().map(xpath -> xpath + "[%").toArray(String[]::new); - deleteByAnchorIdAndXpathLikeAny(anchorId, listXpathPatterns); + deleteByAnchorIdAndXpathLikeAny(anchorId, + xpaths.stream().map(xpath -> EscapeUtils.escapeForSqlLike(xpath) + "[@%").toArray(String[]::new)); } @Query(value = "SELECT xpath FROM fragment WHERE anchor_id = :anchorId AND xpath = ANY (:xpaths)", diff --git a/cps-ri/src/main/java/org/onap/cps/spi/utils/EscapeUtils.java b/cps-ri/src/main/java/org/onap/cps/spi/utils/EscapeUtils.java new file mode 100644 index 0000000000..3092b79051 --- /dev/null +++ b/cps-ri/src/main/java/org/onap/cps/spi/utils/EscapeUtils.java @@ -0,0 +1,33 @@ +/* + * ============LICENSE_START======================================================= + * Copyright (C) 2023 Nordix Foundation + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * SPDX-License-Identifier: Apache-2.0 + * ============LICENSE_END========================================================= + */ + +package org.onap.cps.spi.utils; + +import lombok.AccessLevel; +import lombok.NoArgsConstructor; + +@NoArgsConstructor(access = AccessLevel.PRIVATE) +public class EscapeUtils { + + public static String escapeForSqlLike(final String text) { + return text.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_"); + } + +} diff --git a/cps-ri/src/test/groovy/org/onap/cps/spi/utils/EscapeUtilsSpec.groovy b/cps-ri/src/test/groovy/org/onap/cps/spi/utils/EscapeUtilsSpec.groovy new file mode 100644 index 0000000000..17eb8846a1 --- /dev/null +++ b/cps-ri/src/test/groovy/org/onap/cps/spi/utils/EscapeUtilsSpec.groovy @@ -0,0 +1,36 @@ +/* + * ============LICENSE_START======================================================= + * Copyright (C) 2023 Nordix Foundation + * ================================================================================ + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * SPDX-License-Identifier: Apache-2.0 + * ============LICENSE_END========================================================= + */ + +package org.onap.cps.spi.utils + +import spock.lang.Specification + +class EscapeUtilsSpec extends Specification { + + def 'Escape text for using in SQL LIKE operation'() { + expect: + EscapeUtils.escapeForSqlLike(unescapedText) == escapedText + where: + unescapedText || escapedText + 'Only %, _, and \\ are special' || 'Only \\%, \\_, and \\\\ are special' + 'Others (./?$) are not special' || 'Others (./?$) are not special' + } + +} -- cgit 1.2.3-korg