Openbravo Issue Tracking System - Retail Modules
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0032139Retail ModulesWeb POSpublic2015-10-27 08:452016-03-09 18:33
Reportermtaal 
Assigned ToSandrahuguet 
PrioritynormalSeveritymajorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target VersionRR16Q1Fixed in VersionRR16Q1 
Merge Request Status
Review Assigned Tomarvintm
OBNetwork customer
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0032139: Prevent sql injection in SimpleQueryBuilder
DescriptionAs far as I can see there is a risk of sql injection in the SimpleQueryBuilder. Particularly through this commit:
https://code.openbravo.com/erp/pmods/org.openbravo.mobile.core/diff/02a66121f70c/src/org/openbravo/mobile/core/process/SimpleQueryBuilder.java#l1.31 [^]

(but also previous commits included this)

Steps To ReproduceCheck the code here:
https://code.openbravo.com/erp/pmods/org.openbravo.mobile.core/file/tip/src/org/openbravo/mobile/core/process/SimpleQueryBuilder.java [^]
Proposed SolutionParameters all have to be handled as real parameters in the HQL query and not inlined as strings in the query.
Additional Information
TagsNo tags attached.
Relationships
related to backport 0032566RR16Q1.1 closed Sandrahuguet Improvements in SimpleQueryBuilder 
blocks defect 0031257RR16Q2 closed Sandrahuguet Prevent sql injection in SimpleQueryBuilder 
blocks defect 0032551 closed Sandrahuguet Filter by stockcriteria and pricecriteria in the same query does not work 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2016-02-05 08:27SandrahuguetTypedefect => backport
2016-02-05 08:27SandrahuguetTarget VersionRR16Q2 => RR16Q1
2016-02-09 16:55hgbotCheckin
2016-02-09 16:55hgbotNote Added: 0084059
2016-02-09 16:55hgbotStatusscheduled => resolved
2016-02-09 16:55hgbotResolutionopen => fixed
2016-02-09 16:55hgbotFixed in SCM revision => http://code.openbravo.com/erp/pmods/org.openbravo.mobile.core/rev/8fc1645d949121a1fad530efbd2db845f168e45d [^]
2016-02-09 16:56SandrahuguetStatusresolved => new
2016-02-09 16:56SandrahuguetResolutionfixed => open
2016-02-09 16:56SandrahuguetStatusnew => scheduled
2016-02-09 16:56SandrahuguetNote Deleted: 0084059
2016-02-22 20:12hgbotCheckin
2016-02-22 20:12hgbotNote Added: 0084412
2016-02-22 20:12hgbotStatusscheduled => resolved
2016-02-22 20:12hgbotResolutionopen => fixed
2016-02-22 20:12hgbotFixed in SCM revisionhttp://code.openbravo.com/erp/pmods/org.openbravo.mobile.core/rev/8fc1645d949121a1fad530efbd2db845f168e45d [^] => http://code.openbravo.com/retail/backports/3.0RR16Q1/org.openbravo.mobile.core/rev/1f9bf9d06de9e5724fe7dd2d68faf8327e7c2ac6 [^]
2016-02-22 20:13guilleaerAssigned ToSandrahuguet => guilleaer
2016-02-26 13:41SandrahuguetAssigned Toguilleaer => Sandrahuguet
2016-02-26 13:41SandrahuguetNote Added: 0084568
2016-02-26 13:41SandrahuguetStatusresolved => new
2016-02-26 13:41SandrahuguetResolutionfixed => open
2016-03-07 11:31hgbotCheckin
2016-03-07 11:31hgbotNote Added: 0084760
2016-03-07 11:31SandrahuguetStatusnew => scheduled
2016-03-07 11:31SandrahuguetStatusscheduled => resolved
2016-03-07 11:31SandrahuguetResolutionopen => fixed
2016-03-07 11:31hgbotCheckin
2016-03-07 11:31hgbotNote Added: 0084761
2016-03-07 13:41hgbotCheckin
2016-03-07 13:41hgbotNote Added: 0084774
2016-03-07 13:42hgbotCheckin
2016-03-07 13:42hgbotNote Added: 0084775
2016-03-09 18:33marvintmReview Assigned Tomtaal => marvintm
2016-03-09 18:33marvintmStatusresolved => closed
2016-03-09 18:33marvintmFixed in Version => RR16Q1
2016-03-29 17:49SandrahuguetRelationship addedblocks 0032551
2016-03-31 14:43SandrahuguetRelationship addedrelated to 0032566

Notes
(0084412)
hgbot   
2016-02-22 20:12   
Repository: retail/backports/3.0RR16Q1/org.openbravo.mobile.core
Changeset: 1f9bf9d06de9e5724fe7dd2d68faf8327e7c2ac6
Author: Guillermo Alvarez de Eulate <guillermo.alvarez <at> openbravo.com>
Date: Mon Feb 22 20:11:46 2016 +0100
URL: http://code.openbravo.com/retail/backports/3.0RR16Q1/org.openbravo.mobile.core/rev/1f9bf9d06de9e5724fe7dd2d68faf8327e7c2ac6 [^]

Fixes issue 32139 backport of 31257: Prevent HQL Injection

---
M src/org/openbravo/mobile/core/process/ProcessHQLQuery.java
M src/org/openbravo/mobile/core/process/SimpleQueryBuilder.java
M web/org.openbravo.mobile.core/source/retail/component/ob-retail-searchproductcharacteristic.js
---
(0084568)
Sandrahuguet   
2016-02-26 13:41   
Prevent sql injection in HQLCriteria
(0084760)
hgbot   
2016-03-07 11:31   
Repository: retail/backports/3.0RR16Q1/org.openbravo.mobile.core
Changeset: ca4993e4d2407ec80b48200dc357b199767761e7
Author: Sandra Huguet <sandra.huguet <at> openbravo.com>
Date: Mon Mar 07 11:30:29 2016 +0100
URL: http://code.openbravo.com/retail/backports/3.0RR16Q1/org.openbravo.mobile.core/rev/ca4993e4d2407ec80b48200dc357b199767761e7 [^]

Related to issue 32139 Prevent sql injection in HQLCriteria part

---
M src/org/openbravo/mobile/core/process/HQLCriteriaProcess.java
M src/org/openbravo/mobile/core/process/SimpleQueryBuilder.java
M web/org.openbravo.mobile.core/source/retail/component/ob-retail-searchproductcharacteristic.js
---
(0084761)
hgbot   
2016-03-07 11:31   
Repository: retail/backports/3.0RR16Q1/org.openbravo.retail.posterminal
Changeset: ec5454d821138c7cd8255a4e9c7ca36eac096958
Author: Sandra Huguet <sandra.huguet <at> openbravo.com>
Date: Mon Mar 07 11:29:44 2016 +0100
URL: http://code.openbravo.com/retail/backports/3.0RR16Q1/org.openbravo.retail.posterminal/rev/ec5454d821138c7cd8255a4e9c7ca36eac096958 [^]

Related to issue 32139 Prevent sql injection in HQLCriteria part

---
M src/org/openbravo/retail/posterminal/BrandChHQLCriteria.java
M src/org/openbravo/retail/posterminal/BrandChValueHQLCriteria.java
M src/org/openbravo/retail/posterminal/BrandHQLCriteria.java
M src/org/openbravo/retail/posterminal/CharacteristicHQLCriteria.java
M web/org.openbravo.retail.posterminal/js/components/modalproductcharacteristic.js
A src/org/openbravo/retail/posterminal/ChHQLCriteria.java
A src/org/openbravo/retail/posterminal/ChvHQLCriteria.java
---
(0084774)
hgbot   
2016-03-07 13:41   
Repository: retail/backports/3.0RR16Q1/org.openbravo.retail.posterminal
Changeset: 302190f210558b21c41dfee068f23b2c7837eddf
Author: Sandra Huguet <sandra.huguet <at> openbravo.com>
Date: Mon Mar 07 13:40:45 2016 +0100
URL: http://code.openbravo.com/retail/backports/3.0RR16Q1/org.openbravo.retail.posterminal/rev/302190f210558b21c41dfee068f23b2c7837eddf [^]

related to issue 32139 updated Copyright

---
M src/org/openbravo/retail/posterminal/BrandChValueHQLCriteria.java
M src/org/openbravo/retail/posterminal/BrandHQLCriteria.java
M src/org/openbravo/retail/posterminal/CharacteristicHQLCriteria.java
M web/org.openbravo.retail.posterminal/js/components/modalproductcharacteristic.js
---
(0084775)
hgbot   
2016-03-07 13:42   
Repository: retail/backports/3.0RR16Q1/org.openbravo.mobile.core
Changeset: e0a7f7d49b6ff0c830047c6eb4bce3608fec533b
Author: Sandra Huguet <sandra.huguet <at> openbravo.com>
Date: Mon Mar 07 13:42:32 2016 +0100
URL: http://code.openbravo.com/retail/backports/3.0RR16Q1/org.openbravo.mobile.core/rev/e0a7f7d49b6ff0c830047c6eb4bce3608fec533b [^]

related to issue 32139 updated Copyright

---
M src/org/openbravo/mobile/core/process/HQLCriteriaProcess.java
---