CVE-2019-11343: Insufficient Information (NVD-CWE-noinfo)
value: Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 9.8
Published: 2020-03-12T21:15Z
Repository: https://github.com/xjodoin/torpedoquery
Language: Java
Files changed: src/main/java/org/torpedoquery/jpa/internal/conditions/ConditionBuilder.java, src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java, src/main/java/org/torpedoquery/jpa/internal/conditions/NotLikeCondition.java, src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java, src/test/java/org/torpedoquery/jpa/ValueOnGoingConditionTest.java, src/test/java/org/torpedoquery/jpa/WhereClauseTest.java
Commit date: 2019-10-11 14:59:35 -0400
Commit message: Fix issue with like

Diff: diff --git a/src/main/java/org/torpedoquery/jpa/internal/conditions/ConditionBuilder.java b/src/main/java/org/torpedoquery/jpa/internal/conditions/ConditionBuilder.java
index 9fe016f..9160aa6 100644
--- a/src/main/java/org/torpedoquery/jpa/internal/conditions/ConditionBuilder.java
+++ b/src/main/java/org/torpedoquery/jpa/internal/conditions/ConditionBuilder.java
@@ -251,13 +251,13 @@ public class ConditionBuilder<T> implements OnGoingComparableCondition<T>, OnGoi
 		return getOnGoingLogicalCondition(createLike(LikeCondition.Type.UNKNOW, notLikeValue));
 	}
 
 	private LikeCondition createLike(Type type, String toMatch) {
 		if (notLike) {
-			return new NotLikeCondition(type, selector, toMatch);
+			return new NotLikeCondition(selector, selector.generateParameter(type.wrap(toMatch)));
 		} else {
-			return new LikeCondition(type, selector, toMatch);
+			return new LikeCondition(selector, selector.generateParameter(type.wrap(toMatch)));
 		}
 	}
 
 	/** {@inheritDoc} */
 	@Override
diff --git a/src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java b/src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java
index 7df45e2..e32c695 100644
--- a/src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java
+++ b/src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java
@@ -17,19 +17,14 @@
  * @author xjodoin
  * @version $Id: $Id
  */
 package org.torpedoquery.jpa.internal.conditions;
 
-import java.util.Collections;
-import java.util.List;
-import java.util.concurrent.atomic.AtomicInteger;
-
-import org.torpedoquery.jpa.internal.Condition;
 import org.torpedoquery.jpa.internal.Parameter;
 import org.torpedoquery.jpa.internal.Selector;
 
-public class LikeCondition implements Condition {
+public class LikeCondition<T> extends SingleParameterCondition<T> {
 
 	public static enum Type {
 		ANY {
 			@Override
 			public String wrap(String toMatch) {
@@ -56,53 +51,26 @@ public class LikeCondition implements Condition {
 		};
 
 		public abstract String wrap(String toMatch);
 	}
 
-	private final String toMatch;
-	private final Type type;
-	private final Selector selector;
-
 	/**
 	 * <p>
 	 * Constructor for LikeCondition.
 	 * </p>
 	 *
-	 * @param type
-	 *            a
-	 *            {@link org.torpedoquery.jpa.internal.conditions.LikeCondition.Type}
-	 *            object.
-	 * @param selector
-	 *            a {@link org.torpedoquery.jpa.internal.Selector} object.
-	 * @param toMatch
-	 *            a {@link java.lang.String} object.
+	 * @param type     a
+	 *                 {@link org.torpedoquery.jpa.internal.conditions.LikeCondition.Type}
+	 *                 object.
+	 * @param selector a {@link org.torpedoquery.jpa.internal.Selector} object.
+	 * @param toMatch  a {@link java.lang.String} object.
 	 */
-	public LikeCondition(Type type, Selector selector, String toMatch) {
-		this.type = type;
-		this.selector = selector;
-		this.toMatch = toMatch;
+	public LikeCondition(Selector selector, Parameter<T> parameter) {
+		super(selector, parameter);
 	}
 
-	/** {@inheritDoc} */
 	@Override
-	public String createQueryFragment(AtomicInteger incrementor) {
-		return selector.createQueryFragment(incrementor) + " " + getLike() + " '" + type.wrap(toMatch) + "' ";
-	}
-
-	/**
-	 * <p>
-	 * getLike.
-	 * </p>
-	 *
-	 * @return a {@link java.lang.String} object.
-	 */
-	protected String getLike() {
+	protected String getComparator() {
 		return "like";
 	}
 
-	/** {@inheritDoc} */
-	@Override
-	public List<Parameter> getParameters() {
-		return Collections.emptyList();
-	}
-
 }
diff --git a/src/main/java/org/torpedoquery/jpa/internal/conditions/NotLikeCondition.java b/src/main/java/org/torpedoquery/jpa/internal/conditions/NotLikeCondition.java
index 3661e0b..3bc8fb1 100644
--- a/src/main/java/org/torpedoquery/jpa/internal/conditions/NotLikeCondition.java
+++ b/src/main/java/org/torpedoquery/jpa/internal/conditions/NotLikeCondition.java
@@ -17,26 +17,26 @@
  * @author xjodoin
  * @version $Id: $Id
  */
 package org.torpedoquery.jpa.internal.conditions;
 
+import org.torpedoquery.jpa.internal.Parameter;
 import org.torpedoquery.jpa.internal.Selector;
-public class NotLikeCondition extends LikeCondition {
+public class NotLikeCondition<T> extends LikeCondition<T> {
 
 	/**
 	 * <p>Constructor for NotLikeCondition.</p>
 	 *
 	 * @param type a Type object.
 	 * @param selector a {@link org.torpedoquery.jpa.internal.Selector} object.
 	 * @param toMatch a {@link java.lang.String} object.
 	 */
-	public NotLikeCondition(Type type, Selector selector, String toMatch) {
-		super(type, selector, toMatch);
+	public NotLikeCondition(Selector selector, Parameter<T> parameter) {
+		super(selector,parameter);
 	}
 
-	/** {@inheritDoc} */
 	@Override
-	protected String getLike() {
-		return "not " + super.getLike();
+	protected String getComparator() {
+		return "not " + super.getComparator();
 	}
 
 }
diff --git a/src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java b/src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java
index 6cdc5e3..9bf9f28 100644
--- a/src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java
+++ b/src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java
@@ -94,27 +94,30 @@ public class StringFunctionsTest {
 	@Test
 	public void testWhereWithStringFunction() {
 		Entity from = from(Entity.class);
 		where(lower(from.getCode())).like().any("test");
 		Query<Entity> select = select(from);
-		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like :function_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("function_1"));
 	}
 	
 	@Test
 	public void testWhereWithLikeFunction() {
 		Entity from = from(Entity.class);
 		where(lower(from.getCode())).like("%test%");
 		Query<Entity> select = select(from);
-		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like :function_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("function_1"));
 	}
 	
 	@Test
 	public void testWhereWithNotLikeFunction() {
 		Entity from = from(Entity.class);
 		where(lower(from.getCode())).notLike("%test%");
 		Query<Entity> select = select(from);
-		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) not like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) not like :function_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("function_1"));
 	}
 	
 	/**
 	 * <p>testSubstringFunction.</p>
 	 */
diff --git a/src/test/java/org/torpedoquery/jpa/ValueOnGoingConditionTest.java b/src/test/java/org/torpedoquery/jpa/ValueOnGoingConditionTest.java
index 345263a..0599181 100644
--- a/src/test/java/org/torpedoquery/jpa/ValueOnGoingConditionTest.java
+++ b/src/test/java/org/torpedoquery/jpa/ValueOnGoingConditionTest.java
@@ -117,11 +117,11 @@ public class ValueOnGoingConditionTest {
 		OnGoingLogicalCondition condition = condition(lower(entity.getCode()))
 				.like().any("test");
 		where(condition);
 		Query<Entity> select = select(entity);
 		assertEquals(
-				"select entity_0 from Entity entity_0 where ( lower(entity_0.code) like '%test%'  )",
+				"select entity_0 from Entity entity_0 where ( lower(entity_0.code) like :function_1 )",
 				select.getQuery());
 	}
 
 	/**
 	 * <p>testComparableFunctionInCondition.</p>
diff --git a/src/test/java/org/torpedoquery/jpa/WhereClauseTest.java b/src/test/java/org/torpedoquery/jpa/WhereClauseTest.java
index b5a39e8..ec5d42b 100644
--- a/src/test/java/org/torpedoquery/jpa/WhereClauseTest.java
+++ b/src/test/java/org/torpedoquery/jpa/WhereClauseTest.java
@@ -341,11 +341,12 @@ public class WhereClauseTest {
 	public void test_like_any() {
 		Entity from = from(Entity.class);
 		where(from.getCode()).like().any("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("code_1"));
 	}
 	
 	/**
 	 * <p>test_like_any.</p>
 	 */
@@ -353,11 +354,12 @@ public class WhereClauseTest {
 	public void test_notLike_any() {
 		Entity from = from(Entity.class);
 		where(from.getCode()).notLike().any("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("code_1"));
 	}
 
 	/**
 	 * <p>test_like_startsWith.</p>
 	 */
@@ -365,20 +367,22 @@ public class WhereClauseTest {
 	public void test_like_startsWith() {
 		Entity from = from(Entity.class);
 		where(from.getCode()).like().startsWith("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like 'test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
+		assertEquals("test%", select.getParameters().get("code_1"));
 	}
 	
 	@Test
 	public void test_notLike_startsWith() {
 		Entity from = from(Entity.class);
 		where(from.getCode()).notLike().startsWith("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like 'test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
+		assertEquals("test%", select.getParameters().get("code_1"));
 	}
 
 	/**
 	 * <p>test_like_endsWith.</p>
 	 */
@@ -386,11 +390,12 @@ public class WhereClauseTest {
 	public void test_like_endsWith() {
 		Entity from = from(Entity.class);
 		where(from.getCode()).like().endsWith("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like '%test'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
+		assertEquals("%test", select.getParameters().get("code_1"));
 	}
 	
 	/**
 	 * <p>test_like_endsWith.</p>
 	 */
@@ -398,11 +403,12 @@ public class WhereClauseTest {
 	public void test_notLike_endsWith() {
 		Entity from = from(Entity.class);
 		where(from.getCode()).notLike().endsWith("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like '%test'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
+		assertEquals("%test", select.getParameters().get("code_1"));
 	}
 
 	/**
 	 * <p>test_is_empty.</p>
 	 */

Vulnerable code: 			return new NotLikeCondition(type, selector, toMatch);
			return new LikeCondition(type, selector, toMatch);
import java.util.Collections;
import java.util.List;
import java.util.concurrent.atomic.AtomicInteger;

import org.torpedoquery.jpa.internal.Condition;
public class LikeCondition implements Condition {
	private final String toMatch;
	private final Type type;
	private final Selector selector;

	 * @param type
	 *            a
	 *            {@link org.torpedoquery.jpa.internal.conditions.LikeCondition.Type}
	 *            object.
	 * @param selector
	 *            a {@link org.torpedoquery.jpa.internal.Selector} object.
	 * @param toMatch
	 *            a {@link java.lang.String} object.
	public LikeCondition(Type type, Selector selector, String toMatch) {
		this.type = type;
		this.selector = selector;
		this.toMatch = toMatch;
	/** {@inheritDoc} */
	public String createQueryFragment(AtomicInteger incrementor) {
		return selector.createQueryFragment(incrementor) + " " + getLike() + " '" + type.wrap(toMatch) + "' ";
	}

	/**
	 * <p>
	 * getLike.
	 * </p>
	 *
	 * @return a {@link java.lang.String} object.
	 */
	protected String getLike() {
	/** {@inheritDoc} */
	@Override
	public List<Parameter> getParameters() {
		return Collections.emptyList();
	}

public class NotLikeCondition extends LikeCondition {
	public NotLikeCondition(Type type, Selector selector, String toMatch) {
		super(type, selector, toMatch);
	/** {@inheritDoc} */
	protected String getLike() {
		return "not " + super.getLike();
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like '%test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like '%test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) not like '%test%'", select.getQuery());
				"select entity_0 from Entity entity_0 where ( lower(entity_0.code) like '%test%'  )",
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like '%test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like '%test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like 'test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like 'test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like '%test'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like '%test'", select.getQuery());
Fixed code: 			return new NotLikeCondition(selector, selector.generateParameter(type.wrap(toMatch)));
			return new LikeCondition(selector, selector.generateParameter(type.wrap(toMatch)));
public class LikeCondition<T> extends SingleParameterCondition<T> {
	 * @param type     a
	 *                 {@link org.torpedoquery.jpa.internal.conditions.LikeCondition.Type}
	 *                 object.
	 * @param selector a {@link org.torpedoquery.jpa.internal.Selector} object.
	 * @param toMatch  a {@link java.lang.String} object.
	public LikeCondition(Selector selector, Parameter<T> parameter) {
		super(selector, parameter);
	protected String getComparator() {
import org.torpedoquery.jpa.internal.Parameter;
public class NotLikeCondition<T> extends LikeCondition<T> {
	public NotLikeCondition(Selector selector, Parameter<T> parameter) {
		super(selector,parameter);
	protected String getComparator() {
		return "not " + super.getComparator();
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like :function_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("function_1"));
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like :function_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("function_1"));
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) not like :function_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("function_1"));
				"select entity_0 from Entity entity_0 where ( lower(entity_0.code) like :function_1 )",
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
		assertEquals("test%", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
		assertEquals("test%", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
		assertEquals("%test", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
		assertEquals("%test", select.getParameters().get("code_1"));