bito-code-review[bot] commented on PR #15971:
URL: https://github.com/apache/grails-core/pull/15971#issuecomment-4941960195
<!-- Bito Reply -->
The current implementation of `isUnsafeGStringCoercion` indeed focuses on
the immediate point of coercion (assignment or explicit cast/toString). As
noted in the class Javadoc, the transformer is designed with deliberate
limitations for its first version, specifically that it is intraprocedural and
uses last-write-wins reassignment tracking rather than full dataflow analysis.
To address the scenario where a `GString` is stored in a local variable and
later coerced or passed to a query method, the transformer would need to track
the origin of variables beyond the immediate assignment expression. Currently,
`flattenedStringVars` only stores the `ASTNode` of the declaration or
assignment where the unsafe coercion was detected. Expanding this to detect
cases like `String q = g; Book.executeQuery(q)` would require tracking variable
aliases or propagating the "unsafe" state through variable assignments, which
is significantly more complex than the current implementation.
**grails-datamapping-core/src/main/groovy/org/grails/datastore/gorm/query/transform/GormQuerySafetyTransformer.java**
```
private boolean isUnsafeGStringCoercion(Expression expression, ClassNode
declaredType) {
if (isInterpolatedGString(expression)) {
return ClassHelper.STRING_TYPE.equals(declaredType);
}
if (expression instanceof CastExpression) {
CastExpression cast = (CastExpression) expression;
return ClassHelper.STRING_TYPE.equals(cast.getType()) &&
isInterpolatedGString(cast.getExpression());
}
if (expression instanceof MethodCallExpression) {
MethodCallExpression call = (MethodCallExpression) expression;
return "toString".equals(call.getMethodAsString()) &&
isInterpolatedGString(call.getObjectExpression());
}
return false;
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
