Hibernate
/
hibernate-orm
mirror of https://github.com/hibernate/hibernate-orm
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

HHH-17124 Avoid type pollution in SqmUtil checking for parameters being of type Bindable

This commit is contained in:
Sanne Grinovero 2023-08-22 15:11:19 +02:00 committed by Sanne Grinovero
parent 959ff5ee4d
commit 4c549c46db
1 changed files with 42 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
hibernate-core/src/main/java/org/hibernate/query/sqm/internal/SqmUtil.java
View File

@ -56,6 +56,8 @@ import org.hibernate.sql.exec.spi.JdbcParameterBindings;
import org.hibernate.sql.exec.spi.JdbcParametersList; import org.hibernate.sql.exec.spi.JdbcParametersList;
import org.hibernate.type.JavaObjectType; import org.hibernate.type.JavaObjectType;
import org.hibernate.type.descriptor.converter.spi.BasicValueConverter; import org.hibernate.type.descriptor.converter.spi.BasicValueConverter;
import org.hibernate.type.internal.BasicTypeImpl;
import org.hibernate.type.internal.ConvertedBasicTypeImpl;
import org.hibernate.type.spi.TypeConfiguration; import org.hibernate.type.spi.TypeConfiguration;
/** /**
@ -421,12 +423,19 @@ public class SqmUtil {
List<SqmParameter<?>> sqmParameters, List<SqmParameter<?>> sqmParameters,
SqmParameterMappingModelResolutionAccess mappingModelResolutionAccess, SqmParameterMappingModelResolutionAccess mappingModelResolutionAccess,
SessionFactoryImplementor sessionFactory) { SessionFactoryImplementor sessionFactory) {
if ( binding.getBindType() instanceof Bindable ) {
return (Bindable) binding.getBindType(); {
final Bindable tryOne = asBindable( binding.getBindType() );
if ( tryOne != null ) {
return tryOne;
}
} }
if ( parameter.getHibernateType() instanceof Bindable ) { {
return (Bindable) parameter.getHibernateType(); final Bindable tryTwo = asBindable( parameter.getHibernateType() );
if ( tryTwo != null ) {
return tryTwo;
}
} }
if ( binding.getType() != null ) { if ( binding.getType() != null ) {
@ -447,6 +456,35 @@ public class SqmUtil {
return typeConfiguration.standardBasicTypeForJavaType( parameter.getParameterType() ); return typeConfiguration.standardBasicTypeForJavaType( parameter.getParameterType() );
} }
/**
* Utility to mitigate issues related to type pollution.
* Returns the passes object after casting it to Bindable,
* if the type is compatible.
* If it's not, null will be returned.
* @param o any object instance
* @return a reference to the same object o, but of type Bindable if possible, or null.
*/
private static Bindable asBindable(final Object o) {
if ( o == null ) {
return null;
}
//There a high chance that we're dealing with a BasicTypeImpl, or a subclass of it.
else if ( o instanceof BasicTypeImpl ) {
return (BasicTypeImpl) o;
}
//Alternatively, there's strong chances we're dealing with an ConvertedBasicTypeImpl.
else if ( o instanceof ConvertedBasicTypeImpl ) {
return (ConvertedBasicTypeImpl) o;
}
else {
//Eventually fallback to the standard check for completeness:
if ( o instanceof Bindable ) {
return (Bindable) o;
}
return null;
}
}
public static SqmStatement.ParameterResolutions resolveParameters(SqmStatement<?> statement) { public static SqmStatement.ParameterResolutions resolveParameters(SqmStatement<?> statement) {
if ( statement.getQuerySource() == SqmQuerySource.CRITERIA ) { if ( statement.getQuerySource() == SqmQuerySource.CRITERIA ) {
final CriteriaParameterCollector parameterCollector = new CriteriaParameterCollector(); final CriteriaParameterCollector parameterCollector = new CriteriaParameterCollector();