This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 4c106d7328a0 CAMEL-25353: camel-sql - expand each :#in: parameter
where it is, also when its name starts another name (#27528)
4c106d7328a0 is described below
commit 4c106d7328a0153a225cd89c25e825b8c0178a88
Author: allthingssecurity <[email protected]>
AuthorDate: Thu Oct 8 18:36:00 2026 +0530
CAMEL-25353: camel-sql - expand each :#in: parameter where it is, also when
its name starts another name (#27528)
Co-Authored-By: Claude Opus 5.5 <[email protected]>
---
.../sql/DefaultSqlPrepareStatementStrategy.java | 16 +++--
.../sql/SqlProducerInParameterNamesTest.java | 82 ++++++++++++++++++++++
2 files changed, 92 insertions(+), 6 deletions(-)
diff --git
a/components/camel-sql/src/main/java/org/apache/camel/component/sql/DefaultSqlPrepareStatementStrategy.java
b/components/camel-sql/src/main/java/org/apache/camel/component/sql/DefaultSqlPrepareStatementStrategy.java
index 69c3b8cf00ab..79ec135cfc13 100644
---
a/components/camel-sql/src/main/java/org/apache/camel/component/sql/DefaultSqlPrepareStatementStrategy.java
+++
b/components/camel-sql/src/main/java/org/apache/camel/component/sql/DefaultSqlPrepareStatementStrategy.java
@@ -65,24 +65,28 @@ public class DefaultSqlPrepareStatementStrategy implements
SqlPrepareStatementSt
String answer;
if (allowNamedParameters && hasNamedParameters(query)) {
if (exchange != null) {
- // replace all :?in:word with a number of placeholders for how
many values are expected in the IN values
+ // replace each :?in:word with a number of placeholders for
how many values are expected in the IN values,
+ // in one pass, so a name that is the start of a later name
(:?in:id and :?in:ids), or an expression with
+ // characters that are special in a regular expression, is
replaced where it is and only there
Matcher matcher = REPLACE_IN_PATTERN.matcher(query);
+ StringBuilder sb = new StringBuilder();
while (matcher.find()) {
String found = matcher.group(1);
Object parameter = SqlHelper.lookupParameter(found,
exchange, null);
+ String replace = matcher.group();
if (parameter != null) {
Iterator<?> it = createInParameterIterator(parameter);
StringJoiner replaceBuilder = new StringJoiner(",");
while (it.hasNext()) {
it.next();
- replaceBuilder.add("\\?");
+ replaceBuilder.add("?");
}
- String replace = replaceBuilder.toString();
- String foundEscaped = found.replace("$",
"\\$").replace("{", "\\{").replace("}", "\\}");
- Matcher paramMatcher = Pattern.compile("\\:\\?in\\:" +
foundEscaped, Pattern.MULTILINE).matcher(query);
- query = paramMatcher.replaceAll(replace);
+ replace = replaceBuilder.toString();
}
+ matcher.appendReplacement(sb,
Matcher.quoteReplacement(replace));
}
+ matcher.appendTail(sb);
+ query = sb.toString();
}
// replace all :?word and :?${foo} with just ?
answer = replaceParams(query);
diff --git
a/components/camel-sql/src/test/java/org/apache/camel/component/sql/SqlProducerInParameterNamesTest.java
b/components/camel-sql/src/test/java/org/apache/camel/component/sql/SqlProducerInParameterNamesTest.java
new file mode 100644
index 000000000000..db772fc03392
--- /dev/null
+++
b/components/camel-sql/src/test/java/org/apache/camel/component/sql/SqlProducerInParameterNamesTest.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.sql;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.camel.builder.RouteBuilder;
+import org.apache.camel.test.junit6.CamelTestSupport;
+import org.junit.jupiter.api.Test;
+import org.springframework.jdbc.datasource.embedded.EmbeddedDatabase;
+import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseBuilder;
+import org.springframework.jdbc.datasource.embedded.EmbeddedDatabaseType;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Each :#in: parameter is expanded to the number of its own values, also when
its name is the start of the name of a
+ * later :#in: parameter, or when it is an expression with characters that are
special in a regular expression.
+ */
+class SqlProducerInParameterNamesTest extends CamelTestSupport {
+
+ EmbeddedDatabase db;
+
+ @Override
+ public void doPreSetup() throws Exception {
+ db = new EmbeddedDatabaseBuilder()
+ .setName(getClass().getSimpleName())
+ .setType(EmbeddedDatabaseType.H2)
+ .addScript("sql/createAndPopulateDatabase6.sql").build();
+ }
+
+ @Override
+ public void doPostTearDown() throws Exception {
+ if (db != null) {
+ db.shutdown();
+ }
+ }
+
+ @Test
+ void testNameIsStartOfLaterName() {
+ Map<String, Object> headers = Map.of("project", List.of("Camel"),
"projectLicense", List.of("ASF", "XXX", "YYY"));
+ List<?> rows = template.requestBodyAndHeaders("direct:prefix", null,
headers, List.class);
+ assertEquals(3, rows.size());
+ }
+
+ @Test
+ void testExpressionWithBrackets() {
+ List<?> rows = template.requestBody("direct:expression",
Map.of("names", List.of("Camel", "AMQ")), List.class);
+ assertEquals(8, rows.size());
+ }
+
+ @Override
+ protected RouteBuilder createRouteBuilder() {
+ return new RouteBuilder() {
+ @Override
+ public void configure() {
+ getContext().getComponent("sql",
SqlComponent.class).setDataSource(db);
+
+ from("direct:prefix")
+ .to("sql:select * from projects where project in
(:#in:project)"
+ + " and license in (:#in:projectLicense) order by
id");
+ from("direct:expression")
+ .to("sql:select * from projects where project in
(:#in:${body[names]}) order by id");
+ }
+ };
+ }
+}
