This is an automated email from the ASF dual-hosted git repository. ilgrosso pushed a commit to branch 4_1_X in repository https://gitbox.apache.org/repos/asf/syncope.git
commit 618ba1f48ec745d7c8b0920bff3114089682ee8f Author: Francesco Chicchiriccò <[email protected]> AuthorDate: Fri Aug 28 11:49:37 2026 +0200 Ensuring to accept only valid sort clauses for Task search --- .../core/persistence/jpa/dao/JPATaskDAO.java | 33 +++++++++++++--------- .../core/persistence/neo4j/dao/Neo4jTaskDAO.java | 32 ++++++++++++--------- 2 files changed, 38 insertions(+), 27 deletions(-) diff --git a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java index 8bb3c76669..e89fa12a3a 100644 --- a/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java +++ b/core/persistence-jpa/src/main/java/org/apache/syncope/core/persistence/jpa/dao/JPATaskDAO.java @@ -253,8 +253,8 @@ public class JPATaskDAO implements TaskDAO { StringBuilder subStatement = new StringBuilder(); orderByClauses.forEach(clause -> { - String field = clause.getProperty().trim(); - switch (field) { + String field = null; + switch (clause.getProperty().trim()) { case "latestExecStatus": field = "status"; break; @@ -268,17 +268,24 @@ public class JPATaskDAO implements TaskDAO { break; default: - Field beanField = ReflectionUtils.findField(beanClass, field); - if (beanField != null - && (beanField.getAnnotation(ManyToOne.class) != null - || beanField.getAnnotation(OneToMany.class) != null - || beanField.getAnnotation(OneToOne.class) != null)) { + Field beanField = ReflectionUtils.findField(beanClass, clause.getProperty().trim()); + if (beanField != null) { + field = beanField.getName(); - field += "_id"; + if (beanField.getAnnotation(ManyToOne.class) != null + || beanField.getAnnotation(OneToMany.class) != null + || beanField.getAnnotation(OneToOne.class) != null) { + + field += "_id"; + } } } - subStatement.append(prefix).append(field).append(' ').append(clause.getDirection().name()).append(','); + if (field == null) { + LOG.debug("Unsupported ORDER BY clause: {}", clause.getProperty().trim()); + } else { + subStatement.append(prefix).append(field).append(' ').append(clause.getDirection().name()).append(','); + } }); StringBuilder statement = new StringBuilder(" ORDER BY "); @@ -410,7 +417,7 @@ public class JPATaskDAO implements TaskDAO { map(realmSearchDAO::findByFullPath). filter(Optional::isPresent). flatMap(r -> realmSearchDAO.findDescendants(r.get().getFullPath(), null). - stream()). + stream()). map(Realm::getKey). distinct(). map(realmKey -> "?" + setParameter(parameters, realmKey)). @@ -436,9 +443,9 @@ public class JPATaskDAO implements TaskDAO { boolean orderByTaskExecInfo = pageable.getSort().stream(). anyMatch(clause -> clause.getProperty().equals("start") - || clause.getProperty().equals("end") - || clause.getProperty().equals("latestExecStatus") - || clause.getProperty().equals("status")); + || clause.getProperty().equals("end") + || clause.getProperty().equals("latestExecStatus") + || clause.getProperty().equals("status")); StringBuilder queryString = buildFindAllQuery( type, diff --git a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jTaskDAO.java b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jTaskDAO.java index 924d553d28..498977b5d5 100644 --- a/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jTaskDAO.java +++ b/core/persistence-neo4j/src/main/java/org/apache/syncope/core/persistence/neo4j/dao/Neo4jTaskDAO.java @@ -248,8 +248,8 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO { protected String toOrderByStatement(final Stream<Sort.Order> orderByClauses) { StringBuilder subStatement = new StringBuilder(); orderByClauses.forEach(clause -> { - String field = clause.getProperty().trim(); - switch (field) { + String field = null; + switch (clause.getProperty().trim()) { case "latestExecStatus": field = "status"; break; @@ -265,7 +265,11 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO { default: } - subStatement.append("p.").append(field).append(' ').append(clause.getDirection().name()).append(','); + if (field == null) { + LOG.debug("Unsupported ORDER BY clause: {}", clause.getProperty().trim()); + } else { + subStatement.append("p.").append(field).append(' ').append(clause.getDirection().name()).append(','); + } }); StringBuilder statement = new StringBuilder(" ORDER BY "); @@ -377,7 +381,7 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO { map(realmSearchDAO::findByFullPath). filter(Optional::isPresent). flatMap(r -> realmSearchDAO.findDescendants(r.get().getFullPath(), null). - stream()). + stream()). map(Realm::getKey). distinct(); @@ -512,10 +516,10 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO { t.getActions().stream().filter(act -> !pullTask.getActions().contains(act)). forEach(impl -> deleteRelationship(Neo4jPullTask.NODE, - Neo4jImplementation.NODE, - pullTask.getKey(), - impl.getKey(), - Neo4jPullTask.PULL_TASK_INBOUND_ACTIONS_REL)); + Neo4jImplementation.NODE, + pullTask.getKey(), + impl.getKey(), + Neo4jPullTask.PULL_TASK_INBOUND_ACTIONS_REL)); }); case Neo4jPushTask pushTask -> { @@ -523,12 +527,12 @@ public class Neo4jTaskDAO extends AbstractDAO implements TaskDAO { neo4jTemplate.findById(pushTask.getKey(), Neo4jPushTask.class). ifPresent(t -> t.getActions().stream().filter(act -> !pushTask.getActions().contains(act)). - forEach(impl -> deleteRelationship( - Neo4jPushTask.NODE, - Neo4jImplementation.NODE, - pushTask.getKey(), - impl.getKey(), - Neo4jPushTask.PUSH_TASK_PUSH_ACTIONS_REL))); + forEach(impl -> deleteRelationship( + Neo4jPushTask.NODE, + Neo4jImplementation.NODE, + pushTask.getKey(), + impl.getKey(), + Neo4jPushTask.PUSH_TASK_PUSH_ACTIONS_REL))); } case Neo4jMacroTask macroTask ->
