[Hibernate-JIRA] Created: (HHH-2448) Generate identical column aliases among cluster
by Loïc LEFEVRE (JIRA)
Generate identical column aliases among cluster
-----------------------------------------------
Key: HHH-2448
URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-2448
Project: Hibernate3
Type: Improvement
Components: query-sql
Versions: 3.2.2
Environment: Hibernate version: 3.2.2, 2.1.8
Database: Oracle 9.2.0.8
Reporter: Loïc LEFEVRE
Attachments: report_1.txt, report_2.txt
Among our weblogic cluster (12 instances), we can see that a query can have different column aliases.
Although all seems correct, when regarding database reports like StatsPack or Spotlight we can see that because of these different aliases, the reports are wrong. Indeed, a resource consuming query can see its associated report properties (cpu usage, buffer gets, number of executions...) divided by the number of weblogic instances of our cluster (i.e. divided by 12) thus preventing us to pinpoint the queries to look at.
On a 3 instances cluster, we can see this report:
REPORT#1: one statement with a poor number of buffer gets/execution is reported splitted in 3, see the alias generated for column DTO.CREATION_DATE
for example
On a 4 instances cluster, we can see this report:
REPORT#2: one statement responsible of the latch free/cache buffers chains wait events splitted in 4, note the column alias generated fordeffcashcy0_.BEST_EXPECTED_CY
More than confusing the DBAs about the same query with n different "faces", our reports don't show us all the queries to look at: indeed, in our "Top 50 queries", a lot of them are duplicates! Also the memory required in the SGA to store the queries, the execution plan and so on is increased...
Finally, although the column aliases can have up to 30 characters under Oracle, the limit is set to 10, why?
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators:
http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see:
http://www.atlassian.com/software/jira
11 years, 11 months
[Hibernate-JIRA] Created: (HHH-5255) Bytecode instrumented byte[] lazy properties do not work
by Kyrill Alyoshin (JIRA)
Bytecode instrumented byte[] lazy properties do not work
--------------------------------------------------------
Key: HHH-5255
URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-5255
Project: Hibernate Core
Issue Type: Bug
Components: core
Affects Versions: 3.5.2
Environment: Hibernate-3.5.2, Oracle 10g
Reporter: Kyrill Alyoshin
Well, I have an entity that stores a byte[] property as a Blob.
@Lob
@Basic(optional = false, fetch = FetchType.LAZY)
public byte[] getContent() {
return content;
}
The content can be pretty large, so I marked it as lazy and to enable lazy property fetching I am instrumenting the class at build-time using org.hibernate.tool.instrument.javassist.InstrumentTask just as the documentation says.
However, when I call session.merge on this entity, I can get this stacktrace:
java.lang.ClassCastException: org.hibernate.intercept.LazyPropertyInitializer$1 cannot be cast to [B
at org.hibernate.type.AbstractLongBinaryType.toInternalFormat(AbstractLongBinaryType.java:46)
at org.hibernate.type.AbstractBynaryType.isEqual(AbstractBynaryType.java:134)
at org.hibernate.type.NullableType.isEqual(NullableType.java:233)
at org.hibernate.type.MutableType.replace(MutableType.java:60)
at org.hibernate.type.TypeFactory.replace(TypeFactory.java:548)
at org.hibernate.event.def.DefaultMergeEventListener.copyValues(DefaultMergeEventListener.java:495)
at org.hibernate.event.def.DefaultMergeEventListener.entityIsDetached(DefaultMergeEventListener.java:423)
at org.hibernate.event.def.DefaultMergeEventListener.onMerge(DefaultMergeEventListener.java:234)
at org.hibernate.event.def.DefaultMergeEventListener.onMerge(DefaultMergeEventListener.java:84)
at org.hibernate.impl.SessionImpl.fireMerge(SessionImpl.java:859)
at org.hibernate.impl.SessionImpl.merge(SessionImpl.java:843)
at org.hibernate.impl.SessionImpl.merge(SessionImpl.java:847)
It seems to work fine on session.get()
I think it is a bug.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 11 months
[Hibernate-JIRA] Created: (HHH-3811) Bug: No ability to escape SQL keywords in HQL queries.
by John Roberts (JIRA)
Bug: No ability to escape SQL keywords in HQL queries.
------------------------------------------------------
Key: HHH-3811
URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-3811
Project: Hibernate Core
Issue Type: Bug
Components: core
Affects Versions: 3.3.0.CR1
Environment: 3.3.0.CR1, MS SQL Server 2005 Express
Reporter: John Roberts
Priority: Critical
There appears to be no way to escape property names that are SQL keywords in HQL queries. For example, if you have a property named "key", which is a reasonable name for a property, and you are constructing an HQL query, e.g.:
session.createQuery("select from Entities where key=?");
That will fail on MS SQL Server, because "key" is a reserved T-SQL keyword. However, there is no way to make it succeed, as either an absent-minded developer appears to have forgotten to add the ability to escape keywords to HQL (oops), or it's the secret of the millennium and was left out of the documentation on purpose (it has certainly boggled the minds of the folks on FreeNode #java, #hibernate, and the hibernate forum). Note that none of the following will succeed (this is what I have tried so far):
session.createQuery("select from Entities where key=?");
session.createQuery("select from Entities where [key]=?"); // <-- mssql style still fails to be parsed
session.createQuery("select from Entities where `key`=?");
session.createQuery("select from Entities where 'key'=?");
session.createQuery("select from Entities where \"key\"=?");
session.createQuery("select from Entities where ''key''=?");
session.createQuery("select from Entities where {key}=?");
session.createQuery("select from Entities where <key>=?");
session.createQuery("select from Entities where (key)=?");
session.createQuery("select from Entities where $key$=?");
session.createQuery("select from Entities where $key=?");
Note that using the underlying DBMS's escape method *does* work for column names in the entity mappings, but does not work in actual HQL.
Since most DBMS's have their own dialects of SQL, the inability to escape keywords in HQL means that it is generally impossible to guarantee that any given HQL query will work unless you specifically design your application around the underlying DBMS (which is precisely one of the things you were hoping to avoid with Hibernate -- although on the other hand you're already tied to the DBMS with escaped keywords in the entity mapping anyways).
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 11 months
[Hibernate-JIRA] Created: (HHH-6672) Inserting UNION a HQL and JP-QL query string truncates the query. This makes exploiting HQL Injections easier. Security issue.
by Peter Schuler (JIRA)
Inserting UNION a HQL and JP-QL query string truncates the query. This makes exploiting HQL Injections easier. Security issue.
------------------------------------------------------------------------------------------------------------------------------
Key: HHH-6672
URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-6672
Project: Hibernate Core
Issue Type: Bug
Components: query-hql
Affects Versions: 4.0.0.CR3, 3.6.7
Environment: Mysql Database
Reporter: Peter Schuler
Inserting the word 'union' anywhere in a HQL or JP-QL query truncates the query string. I consider this a security issue because it makes exploiting HQL of JP-QL injections easier.
For example:
from Persoon p where p.persoonId = '1' --> returns just 1 entry.
But:
from Persoon p union where p.persoonId = '1' --> ignores the part after union and returns the whole table.
However:
from Persoon p unionS where p.persoonId = '1' --> or any other word results in a QuerySyntaxException as is expected.
This behaviour is documented in HHH-1050. It looks like this in a halfway implemented feature.
This undocumented behaviour is a security risk because it makes exploiting JP-QL or HQL injections a lot easier. If you can inject into the query string you can easily truncate the remainder of the query. Even if the remainder will somehow restrict the the query result.
This can be fixed changing the behaviour of the query parser by throwing a QuerySyntaxException.
ps: I'll try to add a test case but I hope I've provided enough information.
--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 11 months
[Hibernate-JIRA] Created: (HHH-3818) Hibernate/JBC integration doesn't property handle Entity/CollectionRegionAccessStrategy evict
by Brian Stansberry (JIRA)
Hibernate/JBC integration doesn't property handle Entity/CollectionRegionAccessStrategy evict
---------------------------------------------------------------------------------------------
Key: HHH-3818
URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-3818
Project: Hibernate Core
Issue Type: Bug
Components: caching (L2)
Affects Versions: 3.3.1
Reporter: Brian Stansberry
Assignee: Brian Stansberry
Fix For: 3.3.x
EntityRegionAccessStrategy and CollectionRegionAccessStrategy have evict(Object key) and evictAll() that say they must cause removal of items from the cache "immediately without regard for transaction isolation." The Hibernate/JBC integration is not properly handling this as the JBC removeNode calls it makes are not dealing with transactional issues. The integration needs to:
1) Perhaps suspend any ongoing tx (particularly since these calls are typically made from a tx Synchronization's afterCompletion() callback, when the tx is Status.COMMITTED and it isn't appropriate to call into the cache expecting the cache to incorporate the call into the transaction. (Alhthough I believe JBC handles this correctly by ignoring the tx, since it isn't ACTIVE).
2) Deal with the fact that the tx that is being committed is likely holding locks in JBC. This is the big issue. I believe dealing with this will a) require keeping state in the Hib/JBC integration layer's Region to track that an eviction has occurred but may not be reflected in JBC b) using JBC as a notification bus to propagate the fact of the eviction to other nodes c) attempting to evict the data from JBC locally, failing promptly in the face of lock conflicts d) including in any get() or putFromLoad() calls logic to check the state from a), again attempting to evict locally (with a very short timeout) if not yet evicted and not allowing calls to proceed into JBC until successful.
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
11 years, 11 months