[Hibernate-JIRA] Created: (HV-473) Add option to Canonicalize String Input
by Chris Schmidt (JIRA)
Add option to Canonicalize String Input
---------------------------------------
Key: HV-473
URL: http://opensource.atlassian.com/projects/hibernate/browse/HV-473
Project: Hibernate Validator
Issue Type: Improvement
Components: engine
Environment: n/a
Reporter: Chris Schmidt
Add the ability to enable canonicalization (normalization) of Strings prior to validation processing. By default this behavior should be enabled.
Canonicalization is imperative in validation logic, without it - it is possible to bypass many validation contraints (string based) to perform things like encoding attacks (XSS, SQLi) and Path traversal attacks (RFI, LFI).
This canonicalization should be configurable to allow Multiple or Mixed encoding in a string (with a default to fail validation if either condition is true) through the use of annotation:
@Canonicalize(allowMixed=true, allowMultiple=true)
@Pattern(regexp=".*")
private String someString;
This is necessary, especially when using validation on machine generated values (webservices, etc.) to allow a string to be canonicalized to it's base form even if there are multiple or mixed encodings in the string. However, this is not behavior that a normal application user would display - hence the approach of disallowing a string of this type by default.
Please reference the OWASP ESAPI for an example of how to implement:
http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/ja...
For additional information on the importance of canonicalization in validation see:
https://www.owasp.org/index.php/Canonicalization,_locale_and_Unicode
Feel free to use the ESAPI Library or any of it's code to help Hibernate-Validator be more secure and complete!
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 4 months
[Hibernate-JIRA] Created: (HHH-5086) "ambiguous column" SQL errors in Hibernate 3.5.0 Final
by dnalos (JIRA)
"ambiguous column" SQL errors in Hibernate 3.5.0 Final
------------------------------------------------------
Key: HHH-5086
URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-5086
Project: Hibernate Core
Issue Type: Bug
Components: core
Affects Versions: 3.5.0-Final
Environment: Java JDK 1.6.0_19
Hibernate Core 3.5.0 Final
hibernate-jpa-2.0-api-1.0.0.Final.jar
mysql-connector-java-5.1.10-bin.jar
Reporter: dnalos
Attachments: HibernateAmbiguousTest.zip
After update Hibernate Core to 3.5, we get some Exception like this:
Column '_value' in field list is ambiguous (JDBCExceptionReporter.java:101)
We create a testcase for you, and the Exception from the testcase:
ERROR 15:39:28 0 Column '_value' in field list is ambiguous (JDBCExceptionReporter.java:101)
org.hibernate.exception.ConstraintViolationException: could not load an entity: [Invoice#401]
at org.hibernate.exception.SQLStateConverter.convert(SQLStateConverter.java:96)
at org.hibernate.exception.JDBCExceptionHelper.convert(JDBCExceptionHelper.java:66)
at org.hibernate.loader.Loader.loadEntity(Loader.java:1937)
at org.hibernate.loader.entity.AbstractEntityLoader.load(AbstractEntityLoader.java:86)
at org.hibernate.loader.entity.AbstractEntityLoader.load(AbstractEntityLoader.java:76)
at org.hibernate.persister.entity.AbstractEntityPersister.load(AbstractEntityPersister.java:3270)
at org.hibernate.event.def.DefaultLoadEventListener.loadFromDatasource(DefaultLoadEventListener.java:496)
at org.hibernate.event.def.DefaultLoadEventListener.doLoad(DefaultLoadEventListener.java:477)
at org.hibernate.event.def.DefaultLoadEventListener.load(DefaultLoadEventListener.java:227)
at org.hibernate.event.def.DefaultLoadEventListener.proxyOrLoad(DefaultLoadEventListener.java:285)
at org.hibernate.event.def.DefaultLoadEventListener.onLoad(DefaultLoadEventListener.java:152)
at org.hibernate.impl.SessionImpl.fireLoad(SessionImpl.java:1080)
at org.hibernate.impl.SessionImpl.get(SessionImpl.java:997)
at org.hibernate.impl.SessionImpl.get(SessionImpl.java:990)
at HibernateAmbiguousTest.testAmbiguous(HibernateAmbiguousTest.java:55)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.junit.internal.runners.TestMethod.invoke(TestMethod.java:59)
at org.junit.internal.runners.MethodRoadie.runTestMethod(MethodRoadie.java:98)
at org.junit.internal.runners.MethodRoadie$2.run(MethodRoadie.java:79)
at org.junit.internal.runners.MethodRoadie.runBeforesThenTestThenAfters(MethodRoadie.java:87)
at org.junit.internal.runners.MethodRoadie.runTest(MethodRoadie.java:77)
at org.junit.internal.runners.MethodRoadie.run(MethodRoadie.java:42)
at org.junit.internal.runners.JUnit4ClassRunner.invokeTestMethod(JUnit4ClassRunner.java:88)
at org.junit.internal.runners.JUnit4ClassRunner.runMethods(JUnit4ClassRunner.java:51)
at org.junit.internal.runners.JUnit4ClassRunner$1.run(JUnit4ClassRunner.java:44)
at org.junit.internal.runners.ClassRoadie.runUnprotected(ClassRoadie.java:27)
at org.junit.internal.runners.ClassRoadie.runProtected(ClassRoadie.java:37)
at org.junit.internal.runners.JUnit4ClassRunner.run(JUnit4ClassRunner.java:42)
at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:45)
at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:460)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:673)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:386)
at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:196)
Caused by: com.mysql.jdbc.exceptions.jdbc4.MySQLIntegrityConstraintViolationException: Column '_value' in field list is ambiguous
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27)
at java.lang.reflect.Constructor.newInstance(Constructor.java:513)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:406)
at com.mysql.jdbc.Util.getInstance(Util.java:381)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:1015)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:956)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3558)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3490)
at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1959)
at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:2109)
at com.mysql.jdbc.ConnectionImpl.execSQL(ConnectionImpl.java:2648)
at com.mysql.jdbc.PreparedStatement.executeInternal(PreparedStatement.java:2077)
at com.mysql.jdbc.PreparedStatement.executeQuery(PreparedStatement.java:2228)
at com.mchange.v2.c3p0.impl.NewProxyPreparedStatement.executeQuery(NewProxyPreparedStatement.java:76)
at org.hibernate.jdbc.AbstractBatcher.getResultSet(AbstractBatcher.java:208)
at org.hibernate.loader.Loader.getResultSet(Loader.java:1849)
at org.hibernate.loader.Loader.doQuery(Loader.java:718)
at org.hibernate.loader.Loader.doQueryAndInitializeNonLazyCollections(Loader.java:270)
at org.hibernate.loader.Loader.loadEntity(Loader.java:1933)
... 34 more
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 4 months
[Hibernate-JIRA] Created: (HHH-5905) HQL "where in" queries consume near 100% CPU - possibly for hours
by Marcel Stör (JIRA)
HQL "where in" queries consume near 100% CPU - possibly for hours
-----------------------------------------------------------------
Key: HHH-5905
URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-5905
Project: Hibernate Core
Issue Type: Bug
Affects Versions: 3.5.6
Reporter: Marcel Stör
Priority: Critical
[Claim]
The loop in ParameterParser.parse(String, ParameterParser$Recognizer) uses 100% CPU core per thread that executes it since it iterates over a string char by char and calling string operations in the loop.
[Java client]
Query query = getEntityManager().createQuery("select articleNumber from Article where articleNumber in (:articleNumbers)");
query.setParameter("articleNumbers", articleNumbers);
List<ArticleNumber> filteredArticleNumbers = (List<ArticleNumber>) query.getResultList();
[Stacktrace of involved classes/methods]
ParameterParser.parse(String, ParameterParser$Recognizer) line: 88
ParamLocationRecognizer.parseLocations(String) line: 75
HQLQueryPlan.buildParameterMetadata(ParameterTranslations, String) line: 290
HQLQueryPlan.<init>(String, String, boolean, Map, SessionFactoryImplementor) line: 121
HQLQueryPlan.<init>(String, boolean, Map, SessionFactoryImplementor) line: 80
QueryPlanCache.getHQLQueryPlan(String, boolean, Map) line: 98
SessionImpl(AbstractSessionImpl).getHQLQueryPlan(String, boolean) line: 156
SessionImpl.list(String, QueryParameters) line: 1250
QueryImpl.list() line: 102
QueryImpl<X>.getResultList() line: 241
[Observations]
QueryImpl#list() calls SessionImpl#list(String, QueryParameters) passing the *expanded* query:
return getSession().list(expandParameterLists(namedParams), getQueryParameters(namedParams));
Hence, what is passed to SessionImpl#list(String, QueryParameters) in my case is something like:
select articleNumber from Article where articleNumber in (:articleNumbers0_, :articleNumbers1_, :articleNumbers2_, :articleNumbers3_, :articleNumbers4_, :articleNumbers5_, :articleNumbers6_,
Now imagine how long that query string is when the "where in" query has a few thousand article numbers. org.hibernate.engine.query.ParameterParser.parse(String, Recognizer) then iterates over each character in the query string and calls StringHelper.firstIndexOfChar() for each named parameter. Even on fast servers this operation may easily take half an hour or more (mind you it's a blocking call!) if the expanded query string has a few million characters.
I don't know Hibernate well enough to propose a fix but "where in" with Hibernate is an absolute no-go as it is right now.
We had switch all our "where in" queries to native :-(
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
14 years, 4 months