@Test public void isSafe() { assertTrue(HqlQueryUtils.isSafe("select name from XWikiDocument")); assertTrue(HqlQueryUtils.isSafe("select doc.name, space.name from XWikiDocument doc, XWikiSpace space")); assertTrue(HqlQueryUtils .isSafe("select doc.name, space.name from XWikiDocument doc, XWikiSpace space, OtherTable as ot")); assertTrue(HqlQueryUtils.isSafe("select count(name) from XWikiDocument")); assertTrue(HqlQueryUtils.isSafe("select count(doc.name) from XWikiDocument doc")); assertTrue(HqlQueryUtils .isSafe("select doc.fullName from XWikiDocument as doc, com.xpn.xwiki.objects.StringProperty as str")); assertTrue(HqlQueryUtils.isSafe("select count(*) from XWikiSpace")); assertTrue(HqlQueryUtils.isSafe("select attachment.filename from XWikiAttachment attachment")); assertTrue(HqlQueryUtils.isSafe("select count(*) from XWikiAttachment")); assertFalse(HqlQueryUtils.isSafe("select name from OtherTable")); assertFalse(HqlQueryUtils.isSafe("select doc.* from XWikiDocument doc, XWikiSpace space")); assertFalse(HqlQueryUtils.isSafe("select * from XWikiDocument doc")); assertFalse(HqlQueryUtils.isSafe("select * from XWikiAttachment")); assertFalse(HqlQueryUtils.isSafe("select attachment.mimeType from XWikiAttachment attachment")); assertFalse(HqlQueryUtils .isSafe("select doc.name, ot.field from XWikiDocument doc, XWikiSpace space, OtherTable as ot")); assertFalse(HqlQueryUtils.isSafe("select count(*) from OtherTable")); }
public static boolean isSafe(String statementString) { try { Statement statement = CCJSqlParserUtil.parse(statementString); if (statement instanceof Select) { Select select = (Select) statement; SelectBody selectBody = select.getSelectBody(); if (selectBody instanceof PlainSelect) { PlainSelect plainSelect = (PlainSelect) selectBody; Map<String, String> tables = getTables(plainSelect); for (SelectItem selectItem : plainSelect.getSelectItems()) { if (!isSelectItemAllowed(selectItem, tables)) { return false; } } return true; } } } catch (JSQLParserException e) { LOGGER.warn("Failed to parse request [{}] ([{}]). Considering it not safe.", statementString, ExceptionUtils.getRootCauseMessage(e)); } return false; }
HqlQueryUtils { public static boolean isSafe(String statementString) { try { Statement statement = CCJSqlParserUtil.parse(statementString); if (statement instanceof Select) { Select select = (Select) statement; SelectBody selectBody = select.getSelectBody(); if (selectBody instanceof PlainSelect) { PlainSelect plainSelect = (PlainSelect) selectBody; Map<String, String> tables = getTables(plainSelect); for (SelectItem selectItem : plainSelect.getSelectItems()) { if (!isSelectItemAllowed(selectItem, tables)) { return false; } } return true; } } } catch (JSQLParserException e) { LOGGER.warn("Failed to parse request [{}] ([{}]). Considering it not safe.", statementString, ExceptionUtils.getRootCauseMessage(e)); } return false; } }
HqlQueryUtils { public static boolean isSafe(String statementString) { try { Statement statement = CCJSqlParserUtil.parse(statementString); if (statement instanceof Select) { Select select = (Select) statement; SelectBody selectBody = select.getSelectBody(); if (selectBody instanceof PlainSelect) { PlainSelect plainSelect = (PlainSelect) selectBody; Map<String, String> tables = getTables(plainSelect); for (SelectItem selectItem : plainSelect.getSelectItems()) { if (!isSelectItemAllowed(selectItem, tables)) { return false; } } return true; } } } catch (JSQLParserException e) { LOGGER.warn("Failed to parse request [{}] ([{}]). Considering it not safe.", statementString, ExceptionUtils.getRootCauseMessage(e)); } return false; } private  HqlQueryUtils(); }
HqlQueryUtils { public static boolean isSafe(String statementString) { try { Statement statement = CCJSqlParserUtil.parse(statementString); if (statement instanceof Select) { Select select = (Select) statement; SelectBody selectBody = select.getSelectBody(); if (selectBody instanceof PlainSelect) { PlainSelect plainSelect = (PlainSelect) selectBody; Map<String, String> tables = getTables(plainSelect); for (SelectItem selectItem : plainSelect.getSelectItems()) { if (!isSelectItemAllowed(selectItem, tables)) { return false; } } return true; } } } catch (JSQLParserException e) { LOGGER.warn("Failed to parse request [{}] ([{}]). Considering it not safe.", statementString, ExceptionUtils.getRootCauseMessage(e)); } return false; } private  HqlQueryUtils(); static boolean isShortFormStatement(String statement); static boolean isSafe(String statementString); static String replaceLegacyQueryParameters(String queryString); }
HqlQueryUtils { public static boolean isSafe(String statementString) { try { Statement statement = CCJSqlParserUtil.parse(statementString); if (statement instanceof Select) { Select select = (Select) statement; SelectBody selectBody = select.getSelectBody(); if (selectBody instanceof PlainSelect) { PlainSelect plainSelect = (PlainSelect) selectBody; Map<String, String> tables = getTables(plainSelect); for (SelectItem selectItem : plainSelect.getSelectItems()) { if (!isSelectItemAllowed(selectItem, tables)) { return false; } } return true; } } } catch (JSQLParserException e) { LOGGER.warn("Failed to parse request [{}] ([{}]). Considering it not safe.", statementString, ExceptionUtils.getRootCauseMessage(e)); } return false; } private  HqlQueryUtils(); static boolean isShortFormStatement(String statement); static boolean isSafe(String statementString); static String replaceLegacyQueryParameters(String queryString);  }