CVE-2019-11343 (published 2020-03-12T21:15Z)

Torpedo Query before 2.5.3 mishandles the LIKE operator in ConditionBuilder.java, LikeCondition.java, and NotLikeCondition.java.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/xjodoin/torpedoquery
commit_details: repo_url: https://github.com/xjodoin/torpedoquery
author: Xavier Jodoin
author_date: 2019-10-11 14:59:20-04:00
msg: Fix issue with like
repository: repo_url: https://github.com/xjodoin/torpedoquery
repo_name: xjodoin/torpedoquery
description: Type safe Hibernate query builder (HQL)
repo_language: Java
owner: xjodoin
file_changes: filename: ConditionBuilder.java
change_type: ModificationType.MODIFY
diff: @@ -253,9 +253,9 @@ public class ConditionBuilder<T> implements OnGoingComparableCondition<T>, OnGoi
 
 	private LikeCondition createLike(Type type, String toMatch) {
 		if (notLike) {
-			return new NotLikeCondition(type, selector, toMatch);
+			return new NotLikeCondition(selector, selector.generateParameter(type.wrap(toMatch)));
 		} else {
-			return new LikeCondition(type, selector, toMatch);
+			return new LikeCondition(selector, selector.generateParameter(type.wrap(toMatch)));
 		}
 	}
 

programming_language: Java
filename: LikeCondition.java
change_type: ModificationType.MODIFY
diff: @@ -19,15 +19,10 @@
  */
 package org.torpedoquery.jpa.internal.conditions;
 
-import java.util.Collections;
-import java.util.List;
-import java.util.concurrent.atomic.AtomicInteger;
-
-import org.torpedoquery.jpa.internal.Condition;
 import org.torpedoquery.jpa.internal.Parameter;
 import org.torpedoquery.jpa.internal.Selector;
 
-public class LikeCondition implements Condition {
+public class LikeCondition<T> extends SingleParameterCondition<T> {
 
 	public static enum Type {
 		ANY {
@@ -58,51 +53,24 @@ public class LikeCondition implements Condition {
 		public abstract String wrap(String toMatch);
 	}
 
-	private final String toMatch;
-	private final Type type;
-	private final Selector selector;
-
 	/**
 	 * <p>
 	 * Constructor for LikeCondition.
 	 * </p>
 	 *
-	 * @param type
-	 *            a
-	 *            {@link org.torpedoquery.jpa.internal.conditions.LikeCondition.Type}
-	 *            object.
-	 * @param selector
-	 *            a {@link org.torpedoquery.jpa.internal.Selector} object.
-	 * @param toMatch
-	 *            a {@link java.lang.String} object.
+	 * @param type     a
+	 *                 {@link org.torpedoquery.jpa.internal.conditions.LikeCondition.Type}
+	 *                 object.
+	 * @param selector a {@link org.torpedoquery.jpa.internal.Selector} object.
+	 * @param toMatch  a {@link java.lang.String} object.
 	 */
-	public LikeCondition(Type type, Selector selector, String toMatch) {
-		this.type = type;
-		this.selector = selector;
-		this.toMatch = toMatch;
+	public LikeCondition(Selector selector, Parameter<T> parameter) {
+		super(selector, parameter);
 	}
 
-	/** {@inheritDoc} */
 	@Override
-	public String createQueryFragment(AtomicInteger incrementor) {
-		return selector.createQueryFragment(incrementor) + " " + getLike() + " '" + type.wrap(toMatch) + "' ";
-	}
-
-	/**
-	 * <p>
-	 * getLike.
-	 * </p>
-	 *
-	 * @return a {@link java.lang.String} object.
-	 */
-	protected String getLike() {
+	protected String getComparator() {
 		return "like";
 	}
 
-	/** {@inheritDoc} */
-	@Override
-	public List<Parameter> getParameters() {
-		return Collections.emptyList();
-	}
-
 }

programming_language: Java
filename: NotLikeCondition.java
change_type: ModificationType.MODIFY
diff: @@ -19,8 +19,9 @@
  */
 package org.torpedoquery.jpa.internal.conditions;
 
+import org.torpedoquery.jpa.internal.Parameter;
 import org.torpedoquery.jpa.internal.Selector;
-public class NotLikeCondition extends LikeCondition {
+public class NotLikeCondition<T> extends LikeCondition<T> {
 
 	/**
 	 * <p>Constructor for NotLikeCondition.</p>
@@ -29,14 +30,13 @@ public class NotLikeCondition extends LikeCondition {
 	 * @param selector a {@link org.torpedoquery.jpa.internal.Selector} object.
 	 * @param toMatch a {@link java.lang.String} object.
 	 */
-	public NotLikeCondition(Type type, Selector selector, String toMatch) {
-		super(type, selector, toMatch);
+	public NotLikeCondition(Selector selector, Parameter<T> parameter) {
+		super(selector,parameter);
 	}
 
-	/** {@inheritDoc} */
 	@Override
-	protected String getLike() {
-		return "not " + super.getLike();
+	protected String getComparator() {
+		return "not " + super.getComparator();
 	}
 
 }

programming_language: Java
filename: StringFunctionsTest.java
change_type: ModificationType.MODIFY
diff: @@ -96,7 +96,8 @@ public class StringFunctionsTest {
 		Entity from = from(Entity.class);
 		where(lower(from.getCode())).like().any("test");
 		Query<Entity> select = select(from);
-		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like :function_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("function_1"));
 	}
 	
 	@Test
@@ -104,7 +105,8 @@ public class StringFunctionsTest {
 		Entity from = from(Entity.class);
 		where(lower(from.getCode())).like("%test%");
 		Query<Entity> select = select(from);
-		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) like :function_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("function_1"));
 	}
 	
 	@Test
@@ -112,7 +114,8 @@ public class StringFunctionsTest {
 		Entity from = from(Entity.class);
 		where(lower(from.getCode())).notLike("%test%");
 		Query<Entity> select = select(from);
-		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) not like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where lower(entity_0.code) not like :function_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("function_1"));
 	}
 	
 	/**

programming_language: Java
filename: ValueOnGoingConditionTest.java
change_type: ModificationType.MODIFY
diff: @@ -119,7 +119,7 @@ public class ValueOnGoingConditionTest {
 		where(condition);
 		Query<Entity> select = select(entity);
 		assertEquals(
-				"select entity_0 from Entity entity_0 where ( lower(entity_0.code) like '%test%'  )",
+				"select entity_0 from Entity entity_0 where ( lower(entity_0.code) like :function_1 )",
 				select.getQuery());
 	}
 

programming_language: Java
filename: WhereClauseTest.java
change_type: ModificationType.MODIFY
diff: @@ -343,7 +343,8 @@ public class WhereClauseTest {
 		where(from.getCode()).like().any("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("code_1"));
 	}
 	
 	/**
@@ -355,7 +356,8 @@ public class WhereClauseTest {
 		where(from.getCode()).notLike().any("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like '%test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
+		assertEquals("%test%", select.getParameters().get("code_1"));
 	}
 
 	/**
@@ -367,7 +369,8 @@ public class WhereClauseTest {
 		where(from.getCode()).like().startsWith("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like 'test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
+		assertEquals("test%", select.getParameters().get("code_1"));
 	}
 	
 	@Test
@@ -376,7 +379,8 @@ public class WhereClauseTest {
 		where(from.getCode()).notLike().startsWith("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like 'test%'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
+		assertEquals("test%", select.getParameters().get("code_1"));
 	}
 
 	/**
@@ -388,7 +392,8 @@ public class WhereClauseTest {
 		where(from.getCode()).like().endsWith("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like '%test'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code like :code_1", select.getQuery());
+		assertEquals("%test", select.getParameters().get("code_1"));
 	}
 	
 	/**
@@ -400,7 +405,8 @@ public class WhereClauseTest {
 		where(from.getCode()).notLike().endsWith("test");
 		Query<Entity> select = select(from);
 
-		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like '%test'", select.getQuery());
+		assertEquals("select entity_0 from Entity entity_0 where entity_0.code not like :code_1", select.getQuery());
+		assertEquals("%test", select.getParameters().get("code_1"));
 	}
 
 	/**

programming_language: Java