CVE-2019-11343 (Java, published 2020-03-12T21:15Z)
Description: value: Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: NVD-CWE-noinfo \u2014 Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
Repository: https://github.com/xjodoin/torpedoquery
Files changed:
src/main/java/org/torpedoquery/jpa/internal/conditions/ConditionBuilder.java
src/main/java/org/torpedoquery/jpa/internal/conditions/LikeCondition.java
src/main/java/org/torpedoquery/jpa/internal/conditions/NotLikeCondition.java
src/test/java/org/torpedoquery/jpa/StringFunctionsTest.java
src/test/java/org/torpedoquery/jpa/ValueOnGoingConditionTest.java
src/test/java/org/torpedoquery/jpa/WhereClauseTest.java
Commit message: Fix issue with like


Vulnerable code:
			return new NotLikeCondition(type, selector, toMatch);
			return new LikeCondition(type, selector, toMatch);
import java.util.Collections;
import java.util.List;
import java.util.concurrent.atomic.AtomicInteger;

import org.torpedoquery.jpa.internal.Condition;
public class LikeCondition implements Condition {
	private final String toMatch;
	private final Type type;
	private final Selector selector;

	 * @param type
	 *            a
	 *            {@link org.torpedoquery.jpa.internal.conditions.LikeCondition.Type}
	 *            object.
	 * @param selector
	 *            a {@link org.torpedoquery.jpa.internal.Selector} object.
	 * @param toMatch
	 *            a {@link java.lang.String} object.
	public LikeCondition(Type type, Selector selector, String toMatch) {
		this.type = type;
		this.selector = selector;
		this.toMatch = toMatch;
	/** {@inheritDoc} */
	public String createQueryFragment(AtomicInteger incrementor) {
		return selector.createQueryFragment(incrementor) + " " + getLike() + " '" + type.wrap(toMatch) + "' ";
	}

	/**
	 * <p>
	 * getLike.
	 * </p>
	 *
	 * @return a {@link java.lang.String} object.
	 */
	protected String getLike() {
	/** {@inheritDoc} */
	@Override
	public List<Parameter> getParameters() {
		return Collections.emptyList();
	}

public class NotLikeCondition extends LikeCondition {
	public NotLikeCondition(Type type, Selector selector, String toMatch) {
		super(type, selector, toMatch);
	/** {@inheritDoc} */
	protected String getLike() {
		return "not " + super.getLike();
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like '%test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like '%test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) not like '%test%'", select.getQuery());
				"select entity_0 from Entity entity_0 where ( lower(entity_0.code) like '%test%'  )",
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like '%test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like '%test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like 'test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like 'test%'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like '%test'", select.getQuery());
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like '%test'", select.getQuery());

Fixed code:
			return new NotLikeCondition(selector, selector.generateParameter(type.wrap(toMatch)));
			return new LikeCondition(selector, selector.generateParameter(type.wrap(toMatch)));
public class LikeCondition<T> extends SingleParameterCondition<T> {
	 * @param type     a
	 *                 {@link org.torpedoquery.jpa.internal.conditions.LikeCondition.Type}
	 *                 object.
	 * @param selector a {@link org.torpedoquery.jpa.internal.Selector} object.
	 * @param toMatch  a {@link java.lang.String} object.
	public LikeCondition(Selector selector, Parameter<T> parameter) {
		super(selector, parameter);
	protected String getComparator() {
import org.torpedoquery.jpa.internal.Parameter;
public class NotLikeCondition<T> extends LikeCondition<T> {
	public NotLikeCondition(Selector selector, Parameter<T> parameter) {
		super(selector,parameter);
	protected String getComparator() {
		return "not " + super.getComparator();
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like :function_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("function_1"));
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like :function_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("function_1"));
		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) not like :function_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("function_1"));
				"select entity_0 from Entity entity_0 where ( lower(entity_0.code) like :function_1 )",
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
		assertEquals("%test%", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
		assertEquals("test%", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
		assertEquals("test%", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
		assertEquals("%test", select.getParameters().get("code_1"));
		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
		assertEquals("%test", select.getParameters().get("code_1"));