github-advanced-security[bot] commented on code in PR #16480:
URL: https://github.com/apache/druid/pull/16480#discussion_r1608684557
##########
processing/src/main/java/org/apache/druid/math/expr/Function.java:
##########
@@ -2825,16 +2829,14 @@
}
@Override
- protected ExprEval eval(@Nullable String x, int y)
+ protected ExprEval eval(String x, long y)
{
- if (y < 0) {
+ int yInt = (int) y;
Review Comment:
## User-controlled data in numeric cast
This cast to a narrower type depends on a [user-provided value](1),
potentially causing truncation.
This cast to a narrower type depends on a [user-provided value](2),
potentially causing truncation.
This cast to a narrower type depends on a [user-provided value](3),
potentially causing truncation.
[Show more
details](https://github.com/apache/druid/security/code-scanning/7388)
##########
processing/src/main/java/org/apache/druid/math/expr/Function.java:
##########
@@ -3006,12 +3006,13 @@
}
@Override
- protected ExprEval eval(String x, int y)
+ protected ExprEval eval(String x, long y)
{
- if (x == null) {
- return ExprEval.of(null);
+ int yInt = (int) y;
Review Comment:
## User-controlled data in numeric cast
This cast to a narrower type depends on a [user-provided value](1),
potentially causing truncation.
This cast to a narrower type depends on a [user-provided value](2),
potentially causing truncation.
This cast to a narrower type depends on a [user-provided value](3),
potentially causing truncation.
[Show more
details](https://github.com/apache/druid/security/code-scanning/7390)
##########
processing/src/main/java/org/apache/druid/math/expr/Function.java:
##########
@@ -2854,15 +2856,13 @@
}
@Override
- protected ExprEval eval(@Nullable String x, int y)
+ protected ExprEval eval(String x, long y)
{
- if (y < 0) {
- throw validationFailed("needs a postive integer as second argument");
- }
- if (x == null) {
- return ExprEval.of(null);
+ int yInt = (int) y;
Review Comment:
## User-controlled data in numeric cast
This cast to a narrower type depends on a [user-provided value](1),
potentially causing truncation.
This cast to a narrower type depends on a [user-provided value](2),
potentially causing truncation.
This cast to a narrower type depends on a [user-provided value](3),
potentially causing truncation.
[Show more
details](https://github.com/apache/druid/security/code-scanning/7389)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
