jamesfredley opened a new pull request, #15968: URL: https://github.com/apache/grails-core/pull/15968
## Description ### What was found | Problem | Impact | | --- | --- | | Developers may interpolate values into HQL via GString | Injection risk / unsafe query patterns | | Google Doc 2.6 listed GORM query safety as not covered | No current open PR | | Hard failures would break existing apps | Prefer warn-first starter | ### What changed | Area | Change | | --- | --- | | Utility | `GormQuerySafetyWarnings` detects GString queries with values | | Behavior | Logs a one-time warning per operation/query shape | | Hibernate path | Wire into Hibernate GORM static query APIs | | Docs | Securing against attacks + executeQuery/find refs + upgrade note | | Tests | Warning once / no-warn for plain strings | ### Out of scope / follow-up | Topic | Status | | --- | --- | | Compile-time AST ban of unsafe GString HQL | Follow-up | | Throwing by default | Not this PR (warn only) | | Full internal query audit | Follow-up | ### Related MD topics | Source | Topic | | --- | --- | | Google Doc 2.6 | GORM query safety audit | ## Contributor Checklist ### Issue and Scope - [x] Background explains query-safety gap. - [x] Warn-only, non-breaking starter. - [x] Single focused change. - [x] Targets `8.0.x`. ### Code Quality - [x] Unit tests for warning helper. - [x] Focused datamapping tests intended for CI. - [x] No mass reformatting. - [x] AI starting point labeled. ### Licensing and Attribution - [x] Apache License 2.0. - [x] Contributor rights confirmed. - [x] `ai-generated-starting-point` label applied. ### Documentation - [x] Security and ref docs updated. - [x] PR description explains what changed and why. Assisted-by: Sisyphus:xai/grok-4.5 [gpt-coding] -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
