mirror of
https://github.com/google/nomulus
synced 2026-09-19 14:34:18 +00:00
Remove the ineffective SQL injection check (#1412)
* Remove the ineffective SQL injection check Remove the ineffective SQL-injection attack check in go/r3pr/954. It is quite restrictive, causing a long exempt list. It also doesn't protect queries made through helpers such as QueryComposer etc. We will start from scratch for a new solution.
This commit is contained in:
-1
@@ -569,7 +569,6 @@ public class JpaTransactionManagerImpl implements JpaTransactionManager {
|
||||
}
|
||||
EntityType<?> entityType = getEntityType(key.getKind());
|
||||
ImmutableSet<EntityId> entityIds = getEntityIdsFromSqlKey(entityType, key.getSqlKey());
|
||||
// TODO(b/179158393): use Criteria for query to leave not doubt about sql injection risk.
|
||||
String sql =
|
||||
String.format("DELETE FROM %s WHERE %s", entityType.getName(), getAndClause(entityIds));
|
||||
Query query = query(sql);
|
||||
|
||||
Reference in New Issue
Block a user