Openbravo Issue Tracking System - Retail Modules
View Issue Details
IDProjectCategoryView StatusDate SubmittedLast Update
0052289Retail ModulesWeb POSpublic2023-04-27 18:202023-05-05 09:08
ReporterAugustoMauch 
Assigned ToAugustoMauch 
PrioritynormalSeverityminorReproducibilityhave not tried
StatusclosedResolutionfixed 
PlatformOS5OS Version
Product Version 
Target VersionFixed in Version 
Merge Request Status
Review Assigned To
OBNetwork customer
Support ticket
Regression level
Regression date
Regression introduced in release
Regression introduced by commit
Triggers an Emergency PackNo
Summary0052289: SimpleQueryBuilder improvements
DescriptionSee https://docs.google.com/document/d/1D6fbsv4Ulx0j6VrVKnoSmhX5VW10tbk9yn3AsjA75Z4/edit [^]
Steps To Reproduce-
Proposed Solution
Additional Information
TagsNo tags attached.
Relationships
depends on backport 0052360RR23Q2.1 closed AugustoMauch SimpleQueryBuilder improvements 
depends on backport 0052361RR23Q1.3 closed AugustoMauch SimpleQueryBuilder improvements 
Attached Files
Issue History
Date ModifiedUsernameFieldChange
2023-04-27 18:20AugustoMauchNew Issue
2023-04-27 18:20AugustoMauchAssigned To => AugustoMauch
2023-04-27 18:20AugustoMauchTriggers an Emergency Pack => No
2023-04-27 18:20AugustoMauchStatusnew => scheduled
2023-04-27 18:21hgbotNote Added: 0149039
2023-05-05 09:01hgbotResolutionopen => fixed
2023-05-05 09:01hgbotStatusscheduled => closed
2023-05-05 09:01hgbotNote Added: 0149319
2023-05-05 09:01hgbotFixed in Version => RR23Q3
2023-05-05 09:01hgbotNote Added: 0149320
2023-05-05 09:02AugustoMauchNote Added: 0149321
2023-05-05 09:02AugustoMauchStatusclosed => new
2023-05-05 09:02AugustoMauchResolutionfixed => open
2023-05-05 09:02AugustoMauchFixed in VersionRR23Q3 =>
2023-05-05 09:08AugustoMauchStatusnew => scheduled
2023-05-05 09:08AugustoMauchStatusscheduled => resolved
2023-05-05 09:08AugustoMauchResolutionopen => fixed
2023-05-05 09:08AugustoMauchStatusresolved => closed
2023-05-05 09:08AugustoMauchStatusclosed => new
2023-05-05 09:08AugustoMauchResolutionfixed => open
2023-05-05 09:08AugustoMauchStatusnew => scheduled
2023-05-05 09:08AugustoMauchStatusscheduled => resolved
2023-05-05 09:08AugustoMauchResolutionopen => fixed
2023-05-05 09:08AugustoMauchStatusresolved => closed

Notes
(0149039)
hgbot   
2023-04-27 18:21   
Merge Request created: https://gitlab.com/openbravo/product/pmods/org.openbravo.mobile.core/-/merge_requests/505 [^]
(0149319)
hgbot   
2023-05-05 09:01   
Merge request merged: https://gitlab.com/openbravo/product/pmods/org.openbravo.mobile.core/-/merge_requests/505 [^]
(0149320)
hgbot   
2023-05-05 09:01   
Directly closing issue as related merge request is already approved.

Repository: https://gitlab.com/openbravo/product/pmods/org.openbravo.mobile.core [^]
Changeset: 9080e3a04f06bb8c53bc6fd5be59bd0b3a7179f4
Author: Augusto Mauch <augusto.mauch@openbravo.com>
Date: 05-05-2023 07:01:50
URL: https://gitlab.com/openbravo/product/pmods/org.openbravo.mobile.core/-/commit/9080e3a04f06bb8c53bc6fd5be59bd0b3a7179f4 [^]

Fixes ISSUE-52289: Validates attributes of OrderByCriteria to prevent HQL injection

The OrderByCriteria criteria class accepts two different ways of defining the order by clause: a string
and a JSONArray that contains pairs of properties-sorting directions.

Both were vulnerable to HQL injection attacks. To prevent them, now we are:
- transforming the string param to a JSONArray, checking that the format is the expected one
- validating the JSONArray to check that both properties and sorting directions have the format expected

---
A src-test/org/openbravo/mobile/core/process/OrderByCriteriaValidatorTest.java
A src/org/openbravo/mobile/core/process/OrderByCriteriaValidator.java
M src/org/openbravo/mobile/core/process/SimpleQueryBuilder.java
---
(0149321)
AugustoMauch   
2023-05-05 09:02   
Reopened to create backports