August 2012 - hibernate-issues - Jboss List Archives

[Hibernate-JIRA] Created: (HHH-3811) Bug: No ability to escape SQL keywords in HQL queries.

by John Roberts (JIRA)

Bug: No ability to escape SQL keywords in HQL queries. ------------------------------------------------------ Key: HHH-3811 URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-3811 Project: Hibernate Core Issue Type: Bug Components: core Affects Versions: 3.3.0.CR1 Environment: 3.3.0.CR1, MS SQL Server 2005 Express Reporter: John Roberts Priority: Critical There appears to be no way to escape property names that are SQL keywords in HQL queries. For example, if you have a property named "key", which is a reasonable name for a property, and you are constructing an HQL query, e.g.: session.createQuery("select from Entities where key=?"); That will fail on MS SQL Server, because "key" is a reserved T-SQL keyword. However, there is no way to make it succeed, as either an absent-minded developer appears to have forgotten to add the ability to escape keywords to HQL (oops), or it's the secret of the millennium and was left out of the documentation on purpose (it has certainly boggled the minds of the folks on FreeNode #java, #hibernate, and the hibernate forum). Note that none of the following will succeed (this is what I have tried so far): session.createQuery("select from Entities where key=?"); session.createQuery("select from Entities where [key]=?"); // <-- mssql style still fails to be parsed session.createQuery("select from Entities where `key`=?"); session.createQuery("select from Entities where 'key'=?"); session.createQuery("select from Entities where \"key\"=?"); session.createQuery("select from Entities where ''key''=?"); session.createQuery("select from Entities where {key}=?"); session.createQuery("select from Entities where <key>=?"); session.createQuery("select from Entities where (key)=?"); session.createQuery("select from Entities where $key$=?"); session.createQuery("select from Entities where $key=?"); Note that using the underlying DBMS's escape method *does* work for column names in the entity mappings, but does not work in actual HQL. Since most DBMS's have their own dialects of SQL, the inability to escape keywords in HQL means that it is generally impossible to guarantee that any given HQL query will work unless you specifically design your application around the underlying DBMS (which is precisely one of the things you were hoping to avoid with Hibernate -- although on the other hand you're already tied to the DBMS with escaped keywords in the entity mapping anyways). -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators.... - For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

2
2
0 / 0

[Hibernate-JIRA] Created: (HHH-6672) Inserting UNION a HQL and JP-QL query string truncates the query. This makes exploiting HQL Injections easier. Security issue.

by Peter Schuler (JIRA)

Inserting UNION a HQL and JP-QL query string truncates the query. This makes exploiting HQL Injections easier. Security issue. ------------------------------------------------------------------------------------------------------------------------------ Key: HHH-6672 URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-6672 Project: Hibernate Core Issue Type: Bug Components: query-hql Affects Versions: 4.0.0.CR3, 3.6.7 Environment: Mysql Database Reporter: Peter Schuler Inserting the word 'union' anywhere in a HQL or JP-QL query truncates the query string. I consider this a security issue because it makes exploiting HQL of JP-QL injections easier. For example: from Persoon p where p.persoonId = '1' --> returns just 1 entry. But: from Persoon p union where p.persoonId = '1' --> ignores the part after union and returns the whole table. However: from Persoon p unionS where p.persoonId = '1' --> or any other word results in a QuerySyntaxException as is expected. This behaviour is documented in HHH-1050. It looks like this in a halfway implemented feature. This undocumented behaviour is a security risk because it makes exploiting JP-QL or HQL injections a lot easier. If you can inject into the query string you can easily truncate the remainder of the query. Even if the remainder will somehow restrict the the query result. This can be fixed changing the behaviour of the query parser by throwing a QuerySyntaxException. ps: I'll try to add a test case but I hope I've provided enough information. -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

3
3
0 / 0

[Hibernate-JIRA] Created: (HHH-7293) Change index name to meet Oracle 30 chars limit

by Samuel Fung (JIRA)

Change index name to meet Oracle 30 chars limit ----------------------------------------------- Key: HHH-7293 URL: https://hibernate.onjira.com/browse/HHH-7293 Project: Hibernate ORM Issue Type: Patch Components: core Affects Versions: 4.1.1 Environment: Oracle 11g Reporter: Samuel Fung Priority: Minor Attachments: diff.txt I have an entity class that use table-per-class inheritance. One property in the base class is annotated with @org.hibernate.annotations.Index(name="..."). When Hibernate creates DB schema, the index name is prepended with the concrete class name. The final name exceeds Oracle limit of names <30 chars. I changed org.hibernate.mapping.DenormalizedTable, the index name is the hex string of hashcode of the original name. This comply the Oracle limit while (very likely) maintains uniqueness of the name. Sorry that the submitted patch is not exactly a svn diff (made by diff -u). -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

2
1
0 / 0

[Hibernate-JIRA] Created: (HHH-3818) Hibernate/JBC integration doesn't property handle Entity/CollectionRegionAccessStrategy evict

by Brian Stansberry (JIRA)

Hibernate/JBC integration doesn't property handle Entity/CollectionRegionAccessStrategy evict --------------------------------------------------------------------------------------------- Key: HHH-3818 URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-3818 Project: Hibernate Core Issue Type: Bug Components: caching (L2) Affects Versions: 3.3.1 Reporter: Brian Stansberry Assignee: Brian Stansberry Fix For: 3.3.x EntityRegionAccessStrategy and CollectionRegionAccessStrategy have evict(Object key) and evictAll() that say they must cause removal of items from the cache "immediately without regard for transaction isolation." The Hibernate/JBC integration is not properly handling this as the JBC removeNode calls it makes are not dealing with transactional issues. The integration needs to: 1) Perhaps suspend any ongoing tx (particularly since these calls are typically made from a tx Synchronization's afterCompletion() callback, when the tx is Status.COMMITTED and it isn't appropriate to call into the cache expecting the cache to incorporate the call into the transaction. (Alhthough I believe JBC handles this correctly by ignoring the tx, since it isn't ACTIVE). 2) Deal with the fact that the tx that is being committed is likely holding locks in JBC. This is the big issue. I believe dealing with this will a) require keeping state in the Hib/JBC integration layer's Region to track that an eviction has occurred but may not be reflected in JBC b) using JBC as a notification bus to propagate the fact of the eviction to other nodes c) attempting to evict the data from JBC locally, failing promptly in the face of lock conflicts d) including in any get() or putFromLoad() calls logic to check the state from a), again attempting to evict locally (with a very short timeout) if not yet evicted and not allowing calls to proceed into JBC until successful. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators.... - For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

8
17
0 / 0

[Hibernate-JIRA] Created: (HHH-5665) Allow schema/catalog creation/dropping along the lines of AuxiliaryDatabaseObject

by Steve Ebersole (JIRA)

Allow schema/catalog creation/dropping along the lines of AuxiliaryDatabaseObject --------------------------------------------------------------------------------- Key: HHH-5665 URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-5665 Project: Hibernate Core Issue Type: Sub-task Reporter: Steve Ebersole -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators.... - For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

4
14
0 / 0

[Hibernate-JIRA] Created: (BVAL-192) Add 'exclusive' boolean attribute to @DecimalMin/@DecimalMax constraints

by Jaro Kuruc (JIRA)

Add 'exclusive' boolean attribute to @DecimalMin/@DecimalMax constraints ------------------------------------------------------------------------ Key: BVAL-192 URL: http://opensource.atlassian.com/projects/hibernate/browse/BVAL-192 Project: Bean Validation Issue Type: Improvement Components: spec-general Affects Versions: 1.0 final Environment: Hibernate Validator 4.0.0.GA Reporter: Jaro Kuruc Attachments: patch.patch Hi, may I suggest to enhance @DecimalMin/@DecimalMax constraints with additional 'exclusive' boolean attribute? This would allow to define a constraints like: a positive non-zero decimal number @DecimalMin(value = "0.0", exclusive = true) a negative non-zero decimal number @DecimalMax(value = "0.0", exclusive = true) This makes sense when dealing with decimal numbers where one might want to allow a number regardless of the precision. @DecimalMin("0.0001") vs. @DecimalMin("0.000000001"), etc. To maintain backward compatibility, default value for new 'exclusive' boolean attribute should be false. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators.... - For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

3
11
0 / 0

[Hibernate-JIRA] Created: (BVAL-219) Consider interpolating the value in error messages

by Emmanuel Bernard (JIRA)

Consider interpolating the value in error messages -------------------------------------------------- Key: BVAL-219 URL: http://opensource.atlassian.com/projects/hibernate/browse/BVAL-219 Project: Bean Validation Issue Type: New Feature Reporter: Emmanuel Bernard The main drawback is that there is no formatting and that we will call value.toString() to resolve the value into string. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators.... - For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

3
9
0 / 0

[Hibernate-JIRA] Created: (HHH-6769) invalid Character - problem with aliasing

by bahadir guldiken (JIRA)

invalid Character - problem with aliasing ----------------------------------------- Key: HHH-6769 URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-6769 Project: Hibernate Core Issue Type: Bug Components: core, query-hql Affects Versions: 3.2.6 Environment: oracle 10g, glassfish2.1, solarıs 10, Hibernate3.2.6GA Reporter: bahadir guldiken We have a system running for months without any problem. But somewhat it started to get intermittently: javax.persistence.PersistenceException: org.hibernate.exception.SQLGrammarException: could not execute query ORA-00911 illegal character When we enabled "show_sql" from persistence.xml, we get the following query: Hibernate: select party?dent0_.identity_id as identity1_36_, party?dent0_.description as descript2_36_, party?dent0_.identification_type_id as identifi9_36_, party?dent0_.identity_no as identity3_36_, party?dent0_.issue_date as issue4_36_, party?dent0_.lang_id as lang10_36_, party?dent0_.name as name36_, party?dent0_.party_id as party11_36_, party?dent0_.scan_image as scan6_36_, party?dent0_.validFor_end_date as validFor7_36_, party?dent0_.validFor_start_date as validFor8_36_ from party_identification party?dent0_ where party?dent0_.identity_no=?|#] It seems the aliasing "from party_identification party?dent0_" causing the problem by putting '?'. We suspected from locale or other things but turned away since restarting application was solving the problem for a random period. -- This message is automatically generated by JIRA. For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

2
3
0 / 0

[Hibernate-JIRA] Created: (BVAL-223) Add formatter syntax for interpolated messages

by Emmanuel Bernard (JIRA)

Add formatter syntax for interpolated messages ---------------------------------------------- Key: BVAL-223 URL: http://opensource.atlassian.com/projects/hibernate/browse/BVAL-223 Project: Bean Validation Issue Type: New Feature Components: spec-general Reporter: Emmanuel Bernard -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators.... - For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

3
8
0 / 0

[Hibernate-JIRA] Created: (HHH-6105) PostgreSQL problem when using @Lob on String field

by Roelof Jan Koekoek (JIRA)

PostgreSQL problem when using @Lob on String field -------------------------------------------------- Key: HHH-6105 URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-6105 Project: Hibernate Core Issue Type: Bug Affects Versions: 3.6.3, 3.6.2, 3.6.1, 3.6.0 Environment: postgresql:8.3-606.jdbc3 Reporter: Roelof Jan Koekoek After upgrading from 3.5.6 to 3.6 we ran into issues using @Lob on String fields previously mapping to PostgreSQL's TEXT type. When loading these fields the PostgreSQL driver returns a: "org.postgresql.util.PSQLException: Bad value for type long: Text content..." The problem can be traced to Hibernates ClobTypeDescriptor which calls a resultSet.getClob("lobfield"). Apparently it expects an OID pointing to a clob and not the text field. I found a lengthy discussion on this subject here: http://groups.google.com/group/pgsql.interfaces.jdbc/browse_thread/thread... At the bottom of the discussion a workaround is mentioned. Using @Type(type="org.hibernate.type.StringClobType") on the @Lob String fields gets things working as before, but this is a deprecated solution. -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators.... - For more information on JIRA, see: http://www.atlassian.com/software/jira

11 years, 11 months

4
3
0 / 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

hibernate-issues August 2012