io.codemodder.codemods.HQLParameterizationCodemod.description.md Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of core-codemods Show documentation
Show all versions of core-codemods Show documentation
Codemods for fixing common errors across many Java projects
This change refactors Hibernate queries to be parameterized, rather than built by hand.
Without parameterization, developers must remember to escape inputs using the rules for that database. It's usually buggy, at the least -- and sometimes vulnerable.
Our changes look something like this:
```diff
- Query hqlQuery = session.createQuery("select p from Person p where p.name like '" + tainted + "'");
+ Query hqlQuery = session.createQuery("select p from Person p where p.name like :parameter0").setParameter(":parameter0", tainted);
```