The GitHub Actions job "CI" on grails-core.git/bug/hibernate-8.0.x has failed.
Run started by GitHub user borinquenkid (triggered by borinquenkid).

Head commit for run:
6e71eb580f9d0eebd6c0aa92496157d5f027ab9c / Walter Duque de Estrada 
<[email protected]>
Fix HQL injection: reject plain-String single-arg query overloads

The single-argument CharSequence overloads of find, findAll, executeQuery,
and executeUpdate accepted plain String values without bound parameters,
leaving callers open to HQL/SQL injection via string concatenation.

HqlQueryContext.guardAgainstUnsafeString() now throws
UnsupportedOperationException when a non-GString is passed to any of those
overloads, directing callers to the safe parameterized overloads or Groovy
GString interpolation. Five new Spock features in HqlQueryContextSpec cover
all four method names plus the GString-accepted path.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

Report URL: https://github.com/apache/grails-core/actions/runs/27719442026

With regards,
GitHub Actions via GitBox

Reply via email to