Repository: incubator-fineract Updated Branches: refs/heads/develop a8ac5555c -> 4f63b051d
http://git-wip-us.apache.org/repos/asf/incubator-fineract/blob/b7a5e67b/fineract-provider/src/main/java/org/apache/fineract/portfolio/loanproduct/service/LoanProductReadPlatformServiceImpl.java ---------------------------------------------------------------------- diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/loanproduct/service/LoanProductReadPlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/loanproduct/service/LoanProductReadPlatformServiceImpl.java index 903503d..aea8fe2 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/loanproduct/service/LoanProductReadPlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/loanproduct/service/LoanProductReadPlatformServiceImpl.java @@ -32,6 +32,7 @@ import org.apache.fineract.infrastructure.core.service.RoutingDataSource; import org.apache.fineract.infrastructure.entityaccess.domain.FineractEntityType; import org.apache.fineract.infrastructure.entityaccess.service.FineractEntityAccessUtil; import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext; +import org.apache.fineract.infrastructure.security.utils.SQLInjectionValidator; import org.apache.fineract.organisation.monetary.data.CurrencyData; import org.apache.fineract.portfolio.charge.data.ChargeData; import org.apache.fineract.portfolio.charge.service.ChargeReadPlatformService; @@ -121,7 +122,8 @@ public class LoanProductReadPlatformServiceImpl implements LoanProductReadPlatfo String sql = "select " + rm.schema(); if ((inClause != null) && (!(inClause.trim().isEmpty()))) { - sql += " where lp.id in ( " + inClause + " ) "; + sql += " where lp.id in ("+inClause+") "; + SQLInjectionValidator.validateSQLInput(inClause); } return this.jdbcTemplate.query(sql, rm, new Object[] {}); @@ -534,17 +536,17 @@ public class LoanProductReadPlatformServiceImpl implements LoanProductReadPlatfo final LoanProductMapper rm = new LoanProductMapper(null, null); - String sql = "select " + rm.loanProductSchema() + " where lp.currency_code='" + currencyCode + "'"; + String sql = "select " + rm.loanProductSchema() + " where lp.currency_code= ? "; // Check if branch specific products are enabled. If yes, fetch only // products mapped to current user's office String inClause = fineractEntityAccessUtil .getSQLWhereClauseForProductIDsForUserOffice_ifGlobalConfigEnabled(FineractEntityType.LOAN_PRODUCT); if ((inClause != null) && (!(inClause.trim().isEmpty()))) { - sql += " and id in ( " + inClause + " ) "; + sql += " and id in (" + inClause + ") "; } - return this.jdbcTemplate.query(sql, rm, new Object[] {}); + return this.jdbcTemplate.query(sql, rm, new Object[] {currencyCode}); } @Override http://git-wip-us.apache.org/repos/asf/incubator-fineract/blob/b7a5e67b/fineract-provider/src/main/java/org/apache/fineract/portfolio/meeting/service/MeetingReadPlatformServiceImpl.java ---------------------------------------------------------------------- diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/meeting/service/MeetingReadPlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/meeting/service/MeetingReadPlatformServiceImpl.java index c627350..fe45943 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/meeting/service/MeetingReadPlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/meeting/service/MeetingReadPlatformServiceImpl.java @@ -82,7 +82,8 @@ public class MeetingReadPlatformServiceImpl implements MeetingReadPlatformServic final MeetingDataMapper rm = new MeetingDataMapper(); String sql = rm.schema() + " where ci.entity_id = ? and ci.entity_type_enum = ? "; if (limit != null && limit > 0) { - sql = sql + " order by m.meeting_date desc " + " limit " + limit; + sql = sql + " order by m.meeting_date desc " + " limit ? "; + return this.jdbcTemplate.query(sql, rm, new Object[] { entityId, entityTypeId, limit }); } return this.jdbcTemplate.query(sql, rm, new Object[] { entityId, entityTypeId }); http://git-wip-us.apache.org/repos/asf/incubator-fineract/blob/b7a5e67b/fineract-provider/src/main/java/org/apache/fineract/portfolio/note/service/NoteReadPlatformServiceImpl.java ---------------------------------------------------------------------- diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/note/service/NoteReadPlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/note/service/NoteReadPlatformServiceImpl.java index 4d1788a..dbfeffe 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/note/service/NoteReadPlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/note/service/NoteReadPlatformServiceImpl.java @@ -20,7 +20,10 @@ package org.apache.fineract.portfolio.note.service; import java.sql.ResultSet; import java.sql.SQLException; +import java.util.ArrayList; +import java.util.Arrays; import java.util.Collection; +import java.util.List; import org.apache.commons.lang.StringUtils; import org.apache.fineract.infrastructure.core.data.EnumOptionData; @@ -86,14 +89,16 @@ public class NoteReadPlatformServiceImpl implements NoteReadPlatformService { final NoteType noteType = NoteType.fromInt(noteTypeId); try { final NoteMapper rm = new NoteMapper(); - String conditionSql = getResourceCondition(noteType); + List<Object> paramList = new ArrayList<>( + Arrays.asList(noteId, resourceId)); + String conditionSql = getResourceCondition(noteType, paramList); if (StringUtils.isNotBlank(conditionSql)) { conditionSql = " and " + conditionSql; } final String sql = rm.schema() + " where n.id = ? " + conditionSql + " order by n.created_date DESC"; - return this.jdbcTemplate.queryForObject(sql, rm, new Object[] { noteId, resourceId }); + return this.jdbcTemplate.queryForObject(sql, rm, paramList.toArray()); } catch (final EmptyResultDataAccessException e) { throw new NoteNotFoundException(noteId, resourceId, noteType.name().toLowerCase()); } @@ -103,22 +108,26 @@ public class NoteReadPlatformServiceImpl implements NoteReadPlatformService { public Collection<NoteData> retrieveNotesByResource(final Long resourceId, final Integer noteTypeId) { final NoteType noteType = NoteType.fromInt(noteTypeId); final NoteMapper rm = new NoteMapper(); - final String conditionSql = getResourceCondition(noteType); + List<Object> paramList = new ArrayList<>( + Arrays.asList(resourceId)); + final String conditionSql = getResourceCondition(noteType, paramList); final String sql = rm.schema() + " where " + conditionSql + " order by n.created_date DESC"; - return this.jdbcTemplate.query(sql, rm, new Object[] { resourceId }); + return this.jdbcTemplate.query(sql, rm, paramList.toArray()); } - public static String getResourceCondition(final NoteType noteType) { + public static String getResourceCondition(final NoteType noteType, List<Object> paramList) { String conditionSql = ""; switch (noteType) { case CLIENT: - conditionSql = " n.client_id = ? and note_type_enum = " + NoteType.CLIENT.getValue(); + paramList.add(NoteType.CLIENT.getValue()); + conditionSql = " n.client_id = ? and note_type_enum = ?"; break; case LOAN: - conditionSql = " n.loan_id = ? and ( n.note_type_enum = " + NoteType.LOAN.getValue() + " or n.note_type_enum = " - + NoteType.LOAN_TRANSACTION.getValue() + " )"; + paramList.add(NoteType.LOAN.getValue()); + paramList.add(NoteType.LOAN_TRANSACTION.getValue()); + conditionSql = " n.loan_id = ? and ( n.note_type_enum = ? or n.note_type_enum = ? )"; break; case LOAN_TRANSACTION: conditionSql = " n.loan_transaction_id = ? "; http://git-wip-us.apache.org/repos/asf/incubator-fineract/blob/b7a5e67b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountChargeReadPlatformServiceImpl.java ---------------------------------------------------------------------- diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountChargeReadPlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountChargeReadPlatformServiceImpl.java index 59f7f19..928da15 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountChargeReadPlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountChargeReadPlatformServiceImpl.java @@ -241,21 +241,20 @@ public class SavingsAccountChargeReadPlatformServiceImpl implements SavingsAccou @Override public Collection<SavingsAccountAnnualFeeData> retrieveChargesWithAnnualFeeDue() { - final String sql = "select " + this.chargeDueMapper.schema() + " where sac.charge_due_date is not null and sac.charge_time_enum = " - + ChargeTimeType.ANNUAL_FEE.getValue() + " and sac.charge_due_date <= NOW() and sa.status_enum = " - + SavingsAccountStatusType.ACTIVE.getValue(); + final String sql = "select " + this.chargeDueMapper.schema() + " where sac.charge_due_date is not null and sac.charge_time_enum = ? " + + " and sac.charge_due_date <= NOW() and sa.status_enum = ? "; - return this.jdbcTemplate.query(sql, this.chargeDueMapper, new Object[] {}); + return this.jdbcTemplate.query(sql, this.chargeDueMapper, new Object[] {ChargeTimeType.ANNUAL_FEE.getValue(), SavingsAccountStatusType.ACTIVE.getValue()}); } @Override public Collection<SavingsAccountAnnualFeeData> retrieveChargesWithDue() { final String sql = "select " + this.chargeDueMapper.schema() - + " where sac.charge_due_date is not null and sac.charge_due_date <= NOW() and sac.waived = 0 and sac.is_paid_derived=0 and sac.is_active=1 and sa.status_enum = " - + SavingsAccountStatusType.ACTIVE.getValue() + " order by sac.charge_due_date "; + + " where sac.charge_due_date is not null and sac.charge_due_date <= NOW() and sac.waived = 0 and sac.is_paid_derived=0 and sac.is_active=1 and sa.status_enum = ? " + + " order by sac.charge_due_date "; - return this.jdbcTemplate.query(sql, this.chargeDueMapper, new Object[] {}); + return this.jdbcTemplate.query(sql, this.chargeDueMapper, new Object[] {SavingsAccountStatusType.ACTIVE.getValue()}); } http://git-wip-us.apache.org/repos/asf/incubator-fineract/blob/b7a5e67b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountReadPlatformServiceImpl.java ---------------------------------------------------------------------- diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountReadPlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountReadPlatformServiceImpl.java index cdf6bc2..16e0c19 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountReadPlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsAccountReadPlatformServiceImpl.java @@ -39,6 +39,7 @@ import org.apache.fineract.infrastructure.dataqueries.data.EntityTables; import org.apache.fineract.infrastructure.dataqueries.data.StatusEnum; import org.apache.fineract.infrastructure.dataqueries.service.EntityDatatableChecksReadService; import org.apache.fineract.infrastructure.security.service.PlatformSecurityContext; +import org.apache.fineract.infrastructure.security.utils.ColumnValidator; import org.apache.fineract.organisation.monetary.data.CurrencyData; import org.apache.fineract.organisation.staff.data.StaffData; import org.apache.fineract.organisation.staff.service.StaffReadPlatformService; @@ -106,6 +107,7 @@ public class SavingsAccountReadPlatformServiceImpl implements SavingsAccountRead private final PaginationHelper<SavingsAccountData> paginationHelper = new PaginationHelper<>(); private final EntityDatatableChecksReadService entityDatatableChecksReadService; + private final ColumnValidator columnValidator; @Autowired public SavingsAccountReadPlatformServiceImpl(final PlatformSecurityContext context, final RoutingDataSource dataSource, @@ -113,7 +115,7 @@ public class SavingsAccountReadPlatformServiceImpl implements SavingsAccountRead final SavingsProductReadPlatformService savingProductReadPlatformService, final StaffReadPlatformService staffReadPlatformService, final SavingsDropdownReadPlatformService dropdownReadPlatformService, final ChargeReadPlatformService chargeReadPlatformService, - final EntityDatatableChecksReadService entityDatatableChecksReadService) { + final EntityDatatableChecksReadService entityDatatableChecksReadService, final ColumnValidator columnValidator) { this.context = context; this.jdbcTemplate = new JdbcTemplate(dataSource); this.clientReadPlatformService = clientReadPlatformService; @@ -127,6 +129,7 @@ public class SavingsAccountReadPlatformServiceImpl implements SavingsAccountRead // this.annualFeeMapper = new SavingsAccountAnnualFeeMapper(); this.chargeReadPlatformService = chargeReadPlatformService; this.entityDatatableChecksReadService = entityDatatableChecksReadService; + this.columnValidator = columnValidator; } @Override @@ -179,6 +182,7 @@ public class SavingsAccountReadPlatformServiceImpl implements SavingsAccountRead String sqlQueryCriteria = searchParameters.getSqlSearch(); if (StringUtils.isNotBlank(sqlQueryCriteria)) { sqlQueryCriteria = sqlQueryCriteria.replaceAll("accountNo", "sa.account_no"); + this.columnValidator.validateSqlInjection(sqlBuilder.toString(), sqlQueryCriteria); sqlBuilder.append(" and (").append(sqlQueryCriteria).append(")"); } http://git-wip-us.apache.org/repos/asf/incubator-fineract/blob/b7a5e67b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductReadPlatformServiceImpl.java ---------------------------------------------------------------------- diff --git a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductReadPlatformServiceImpl.java b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductReadPlatformServiceImpl.java index 454cbe3..4758b01 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductReadPlatformServiceImpl.java +++ b/fineract-provider/src/main/java/org/apache/fineract/portfolio/savings/service/SavingsProductReadPlatformServiceImpl.java @@ -278,7 +278,7 @@ public class SavingsProductReadPlatformServiceImpl implements SavingsProductRead this.context.authenticatedUser(); - String sql = "select " + this.savingsProductRowMapper.schema() + " where sp.currency_code='" + currencyCode + "'"; + String sql = "select " + this.savingsProductRowMapper.schema() + " where sp.currency_code= ? "; // Check if branch specific products are enabled. If yes, fetch only // products mapped to current user's office @@ -288,6 +288,6 @@ public class SavingsProductReadPlatformServiceImpl implements SavingsProductRead sql += " and id in ( " + inClause + " ) "; } - return this.jdbcTemplate.query(sql, this.savingsProductRowMapper); + return this.jdbcTemplate.query(sql, this.savingsProductRowMapper, new Object[] {currencyCode}); } } \ No newline at end of file
