Skip to content

Commit 9076fde

Browse files
velovelo
committed
Merge remote-tracking branch 'origin/master' into querydsl-7.0
2 parents d25175f + 30bd68a commit 9076fde

File tree

10 files changed

+49
-13
lines changed

10 files changed

+49
-13
lines changed

‎.github/workflows/dependency-submission.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,6 @@ jobs:
2424
java-version: '21'
2525

2626
- name: Submit Dependency Snapshot
27-
uses: advanced-security/maven-dependency-submission-action@v3
27+
uses: advanced-security/maven-dependency-submission-action@v4.1.1
2828
with:
2929
maven-args: -Dtoolchain.skip=true

‎pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -117,7 +117,7 @@
117117
<h2.version>2.3.232</h2.version>
118118
<postgresql.version>42.7.4</postgresql.version>
119119
<oracle.version>23.6.0.24.10</oracle.version>
120-
<mysql.version>8.0.30</mysql.version>
120+
<mysql.version>9.1.0</mysql.version>
121121
<mssql.version>12.9.0.jre8-preview</mssql.version>
122122
<cubrid.version>9.3.9.0002</cubrid.version>
123123
<sqlite.version>3.47.1.0</sqlite.version>

‎querydsl-libraries/querydsl-core/src/main/java/com/querydsl/core/types/dsl/PathBuilderValidator.java‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.io.Serializable;
2020
import java.util.Collection;
2121
import java.util.Map;
22+
import java.util.regex.Pattern;
2223

2324
/** {@code PathBuilderValidator} validates {@link PathBuilder} properties at creation time */
2425
public interface PathBuilderValidator extends Serializable {
@@ -35,8 +36,14 @@ public interface PathBuilderValidator extends Serializable {
3536

3637
PathBuilderValidator DEFAULT =
3738
new PathBuilderValidator() {
39+
40+
private Pattern SPACES = Pattern.compile("\\s");
41+
3842
@Override
3943
public Class<?> validate(Class<?> parent, String property, Class<?> propertyType) {
44+
if (SPACES.matcher(property).find()) {
45+
throw new IllegalStateException("Unsafe due to CVE-2024-49203");
46+
}
4047
return propertyType;
4148
}
4249
};

‎querydsl-libraries/querydsl-core/src/test/java/com/querydsl/core/types/dsl/PathBuilderTest.java‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,13 @@
1414
package com.querydsl.core.types.dsl;
1515

1616
import static org.assertj.core.api.Assertions.assertThat;
17+
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
18+
import static org.junit.jupiter.api.Assertions.assertThrows;
1719

1820
import com.querydsl.core.BooleanBuilder;
21+
import com.querydsl.core.domain.Cat;
22+
import com.querydsl.core.types.Order;
23+
import com.querydsl.core.types.OrderSpecifier;
1924
import com.querydsl.core.util.BeanMap;
2025
import java.sql.Time;
2126
import java.util.Date;
@@ -128,4 +133,25 @@ public void calling_get_with_the_same_name_and_different_types_returns_correct_t
128133
assertThat(entity.get(pathName, Comparable.class).getType()).isEqualTo(String.class);
129134
assertThat(entity.get(pathName, Object.class).getType()).isEqualTo(String.class);
130135
}
136+
137+
@Test
138+
public void order_HQL_injection() {
139+
var orderBy = "breed";
140+
var pathBuilder = new PathBuilder<Cat>(Cat.class, "entity");
141+
assertDoesNotThrow(() -> new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy)));
142+
}
143+
144+
@Test
145+
// CVE-2024-49203
146+
// https://github.com/OpenFeign/querydsl/security/advisories/GHSA-6q3q-6v5j-h6vg
147+
public void unsafe_order_HQL_injection() {
148+
var orderBy =
149+
"test.name INTERSECT SELECT t FROM Test t WHERE (SELECT cast(pg_sleep(10) AS text))='2' ORDER BY t.id";
150+
var pathBuilder = new PathBuilder<Cat>(Cat.class, "entity");
151+
var error =
152+
assertThrows(
153+
IllegalStateException.class,
154+
() -> new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy)));
155+
assertThat(error).hasMessageContaining("CVE-2024-49203");
156+
}
131157
}

‎querydsl-libraries/querydsl-jpa/pom.xml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@
140140
<scope>test</scope>
141141
</dependency>
142142
<dependency>
143-
<groupId>mysql</groupId>
144-
<artifactId>mysql-connector-java</artifactId>
143+
<groupId>com.mysql</groupId>
144+
<artifactId>mysql-connector-j</artifactId>
145145
<version>${mysql.version}</version>
146146
<scope>test</scope>
147147
</dependency>
@@ -314,7 +314,7 @@
314314
<version>${project.version}</version>
315315
<configuration>
316316
<jdbcDriver>org.apache.derby.jdbc.EmbeddedDriver</jdbcDriver>
317-
<jdbcUrl>jdbc:derby:target/derbydb;create=true</jdbcUrl>
317+
<jdbcUrl>jdbc:derby:${project.build.directory}/derbydb;create=true</jdbcUrl>
318318
<packageName>com.querydsl.jpa.domain.sql</packageName>
319319
<targetFolder>src/test/java</targetFolder>
320320
<sourceFolder>src/test/java</sourceFolder>

‎querydsl-libraries/querydsl-sql-json/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -83,8 +83,8 @@
8383
<scope>test</scope>
8484
</dependency>
8585
<dependency>
86-
<groupId>mysql</groupId>
87-
<artifactId>mysql-connector-java</artifactId>
86+
<groupId>com.mysql</groupId>
87+
<artifactId>mysql-connector-j</artifactId>
8888
<version>${mysql.version}</version>
8989
<scope>test</scope>
9090
</dependency>

‎querydsl-libraries/querydsl-sql-spatial/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,8 +70,8 @@
7070
<scope>test</scope>
7171
</dependency>
7272
<dependency>
73-
<groupId>mysql</groupId>
74-
<artifactId>mysql-connector-java</artifactId>
73+
<groupId>com.mysql</groupId>
74+
<artifactId>mysql-connector-j</artifactId>
7575
<version>${mysql.version}</version>
7676
<scope>test</scope>
7777
</dependency>

‎querydsl-libraries/querydsl-sql/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,8 @@
6767
<scope>test</scope>
6868
</dependency>
6969
<dependency>
70-
<groupId>mysql</groupId>
71-
<artifactId>mysql-connector-java</artifactId>
70+
<groupId>com.mysql</groupId>
71+
<artifactId>mysql-connector-j</artifactId>
7272
<version>${mysql.version}</version>
7373
<scope>test</scope>
7474
</dependency>

‎querydsl-libraries/querydsl-sql/src/main/resources/keywords/mysql‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,7 @@ LONGBLOB
131131
LONGTEXT
132132
LOOP
133133
LOW_PRIORITY
134+
MANUAL
134135
MASTER_BIND
135136
MASTER_SSL_VERIFY_SERVER_CERT
136137
MATCH
@@ -160,12 +161,14 @@ ORDER
160161
OUT
161162
OUTER
162163
OUTFILE
164+
PARALLEL
163165
PERSIST
164166
PERSIST_ONLY
165167
PRECISION
166168
PRIMARY
167169
PROCEDURE
168170
PURGE
171+
QUALIFY
169172
RANGE
170173
READ
171174
READ_WRITE

‎querydsl-tooling/querydsl-sql-codegen/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -69,8 +69,8 @@
6969
<scope>test</scope>
7070
</dependency>
7171
<dependency>
72-
<groupId>mysql</groupId>
73-
<artifactId>mysql-connector-java</artifactId>
72+
<groupId>com.mysql</groupId>
73+
<artifactId>mysql-connector-j</artifactId>
7474
<version>${mysql.version}</version>
7575
<scope>test</scope>
7676
</dependency>

0 commit comments

Comments
 (0)