[
https://issues.apache.org/jira/browse/PHOENIX-6560?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17712928#comment-17712928
]
ASF GitHub Bot commented on PHOENIX-6560:
-----------------------------------------
stoty commented on code in PR #1586:
URL: https://github.com/apache/phoenix/pull/1586#discussion_r1162935895
##########
phoenix-core/src/main/java/org/apache/phoenix/schema/transform/Transform.java:
##########
@@ -472,25 +473,41 @@ public static void doCutover(PhoenixConnection
connection, SystemTransformRecord
getMetadataDifference(connection, systemTransformRecord, columnNames,
columnValues);
// TODO In the future, we need to handle rowkey changes and column
type changes as well
- String
- changeViewStmt = "UPSERT INTO SYSTEM.CATALOG (TENANT_ID,
TABLE_SCHEM, TABLE_NAME %s) VALUES (%s, %s, '%s' %s)";
+ String changeViewStmt = "UPSERT INTO SYSTEM.CATALOG "
+ + "(TENANT_ID, TABLE_SCHEM, TABLE_NAME %s) VALUES (?, ?, ? %s)";
String
- changeTable = String.format(
- "UPSERT INTO SYSTEM.CATALOG (TENANT_ID, TABLE_SCHEM,
TABLE_NAME, PHYSICAL_TABLE_NAME %s) VALUES (%s, %s, '%s','%s' %s)",
- (columnNames.size() > 0? "," + String.join(",",
columnNames):""),
- (tenantId==null? null: ("'" + tenantId + "'")),
- (schema==null ? null : ("'" + schema + "'")), tableName,
newTableName,
- (columnValues.size() > 0? "," + String.join(",",
columnValues):""));
+ changeTable = String.format("UPSERT INTO SYSTEM.CATALOG "
+ + "(TENANT_ID, TABLE_SCHEM, TABLE_NAME, PHYSICAL_TABLE_NAME %s
) "
+ + "VALUES(?, ?, ?, ? %s)", columnNames.size() > 0 ? ","
+ + String.join(",", columnNames) : "",
Review Comment:
This is another case, when we should generate ? s and call setString for
each element,
> Rewrite dynamic SQL queries to use Preparedstatement
> ----------------------------------------------------
>
> Key: PHOENIX-6560
> URL: https://issues.apache.org/jira/browse/PHOENIX-6560
> Project: Phoenix
> Issue Type: Improvement
> Components: core
> Reporter: Istvan Toth
> Assignee: Abhishek Kothalikar
> Priority: Major
>
> Most of the Phoenix code base already uses PreparedStatements, and adds all
> potentially vulnerable data as parameters.
> However, there are some places where we concatenate potentially problematic
> strings into the query.
> While most of those are constants and such, we should preferably pass all
> data as parameters to be on the safe side.
> (We still have to use dynamic strings for the preparedstatement strings, for
> handling things as is null, empty in clauses and such)
> Spotbugs marks these with SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE, so
> they're easy to find.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
