[Hibernate-JIRA] Created: (HV-438) Call to TraversableResolver.isReachable() threw an exception
by Denis Chapligin (JIRA)
Call to TraversableResolver.isReachable() threw an exception
------------------------------------------------------------
Key: HV-438
URL: http://opensource.atlassian.com/projects/hibernate/browse/HV-438
Project: Hibernate Validator
Issue Type: Bug
Components: engine
Affects Versions: 4.2.0.Beta1, 4.1.0.Final
Environment: hibernate 3.6.1.Final and hibernate validator 4.1.0.Final, GlassFish Server Open Source Edition 3.0.1, Spring 3.0.5
Reporter: Denis Chapligin
I have a problem with custom class level constraint. When i try to validate a simple entity, like:
@Entity
@Table(name="users")
@Unique //My custom constraint
public class User implements Serializable {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
@Column(name="id")
private Integer id;
}
using a spring validation helper:
User u = new User();
Errors result = new BindException(u,"User");
validator.validate(u,result);
It throws a NullPointer exception:
#
Caused by: java.lang.NullPointerException
#
at java.lang.Class.searchFields(Class.java:2599)
#
at java.lang.Class.getDeclaredField(Class.java:1880)
#
at org.hibernate.ejb.util.PersistenceUtilHelper$MetadataCache.findMember(PersistenceUtilHelper.java:190)
#
at org.hibernate.ejb.util.PersistenceUtilHelper$MetadataCache.getMember(PersistenceUtilHelper.java:178)
#
at org.hibernate.ejb.util.PersistenceUtilHelper.get(PersistenceUtilHelper.java:91)
#
at org.hibernate.ejb.util.PersistenceUtilHelper.isLoadedWithReference(PersistenceUtilHelper.java:83)
#
at org.hibernate.ejb.HibernatePersistence$1.isLoadedWithReference(HibernatePersistence.java:93)
#
at javax.persistence.Persistence$PersistenceUtilImpl.isLoaded(Persistence.java:120)
#
at org.hibernate.validator.engine.resolver.JPATraversableResolver.isReachable(JPATraversableResolver.java:33)
#
at org.hibernate.validator.engine.resolver.DefaultTraversableResolver.isReachable(DefaultTraversableResolver.java:112)
#
at org.hibernate.validator.engine.resolver.SingleThreadCachedTraversableResolver.isReachable(SingleThreadCachedTraversableResolver.java:47)
#
at org.hibernate.validator.engine.ValidatorImpl.isValidationRequired(ValidatorImpl.java:764)
Some investigation revealed, that in PersistenceUtil calls the 'property' parameter value is null and in the validator.engine functions 'name' var in value of the first and single entry of propertyPath.nodeList is null too.
Mot interested thing, is that when i try validation code, shown above, in JUnit environment, it works well.
I've attached a simple webapp, that reproduces the issue. It is too big, to be uploaded here, so i put it to the dropbox: http://dl.dropbox.com/u/17691684/hvbug.tar.gz Initial report was on hibernate forums: https://forum.hibernate.org/viewtopic.php?f=9&t=1009612&start=0
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 1 month
[Hibernate-JIRA] Created: (HHH-5902) In Oracle Dialect Paging query always contains "rownum" pseudo-column when the first result > 0
by Andremoniy (JIRA)
In Oracle Dialect Paging query always contains "rownum" pseudo-column when the first result > 0
-----------------------------------------------------------------------------------------------
Key: HHH-5902
URL: http://opensource.atlassian.com/projects/hibernate/browse/HHH-5902
Project: Hibernate Core
Issue Type: Bug
Components: core, query-sql
Affects Versions: 3.3.2
Environment: Java 1.5, Java 1.6...
Reporter: Andremoniy
Priority: Critical
The issue is about paging query.
For example, we have simple SQL Query: "SELECT p.ID FROM SomeTable p ORDER BY p.ID".
SQLQuery testQuery = HibernateUtil.currentSession().createSQLQuery("SELECT p.ID FROM SomeTable p ORDER BY p.ID");
When we set:
testQuery.setFirstResult(0);
testQuery.setMaxResults(10);
List objs = testQuery.list();
"objs" will contain 10 simple objects of String type (for example).
But, when se set:
testQuery.setFirstResult(10); // here, any value > 0
testQuery.setMaxResults(10);
List objs = testQuery.list();
we will receive list of Object[2] objects:
ID ROWNUM
3212 11
5212 12
5435 13
...
It is absolutely clear, that the core of the problem is in this construction:
Oracle9iDialect.class,
public String getLimitString(String sql, boolean hasOffset) {
...
if (hasOffset) {
pagingSelect.append("select * from ( select row_.*, rownum rownum_ from ( ");
}
The resulting query will be:
select * from ( select row_.*, rownum rownum_ from ( SELECT p.ID FROM SomeTable p ORDER BY p.ID ) row_ where rownum <=20) where rownum_ > 10
Why this is a bug?
1. Because I don't want to check: if my query will return simple Object types or Object[] depends on "First Result value".
2. Because I don't need to have second pseudo-column with "rownum" value. It must be optional parameter.
Simple solution for this example could be (see on >>> ID <<<):
select >>> ID <<< from ( select row_.*, rownum rownum_ from ( SELECT p.ID FROM SomeTable p ORDER BY p.ID ) row_ where rownum <=20) where rownum_ > 10
But, of course, in this case this first part of "select" query must be retranslated from inner source query (so, it will be not "SELECT p.ID..." but "SELECT ID" and so on).
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 1 month
[Hibernate-JIRA] Created: (HV-473) Add option to Canonicalize String Input
by Chris Schmidt (JIRA)
Add option to Canonicalize String Input
---------------------------------------
Key: HV-473
URL: http://opensource.atlassian.com/projects/hibernate/browse/HV-473
Project: Hibernate Validator
Issue Type: Improvement
Components: engine
Environment: n/a
Reporter: Chris Schmidt
Add the ability to enable canonicalization (normalization) of Strings prior to validation processing. By default this behavior should be enabled.
Canonicalization is imperative in validation logic, without it - it is possible to bypass many validation contraints (string based) to perform things like encoding attacks (XSS, SQLi) and Path traversal attacks (RFI, LFI).
This canonicalization should be configurable to allow Multiple or Mixed encoding in a string (with a default to fail validation if either condition is true) through the use of annotation:
@Canonicalize(allowMixed=true, allowMultiple=true)
@Pattern(regexp=".*")
private String someString;
This is necessary, especially when using validation on machine generated values (webservices, etc.) to allow a string to be canonicalized to it's base form even if there are multiple or mixed encodings in the string. However, this is not behavior that a normal application user would display - hence the approach of disallowing a string of this type by default.
Please reference the OWASP ESAPI for an example of how to implement:
http://code.google.com/p/owasp-esapi-java/source/browse/trunk/src/main/ja...
For additional information on the importance of canonicalization in validation see:
https://www.owasp.org/index.php/Canonicalization,_locale_and_Unicode
Feel free to use the ESAPI Library or any of it's code to help Hibernate-Validator be more secure and complete!
--
This message is automatically generated by JIRA.
-
If you think it was sent incorrectly contact one of the administrators: http://opensource.atlassian.com/projects/hibernate/secure/Administrators....
-
For more information on JIRA, see: http://www.atlassian.com/software/jira
13 years, 1 month