Uploaded image for project: 'EJBCA'
  1. EJBCA
  2. ECA-9023

Use prepared statements in ApprovalSessionBean and java.util.query.Query

    Details

    • Type: Improvement
    • Status: Reopened
    • Priority: Minor
    • Resolution: Unresolved
    • Affects Version/s: None
    • Fix Version/s: None
    • Component/s: None
    • Provenance:
      Refactorization
    • Issue discovered during:
      Another issue
    • Sprint:
      Issues to Consider for Plan, EJBCA Team Bob - 2020 w16

      Description

      Currently, we build the SQL queries in ApprovalSessionBean by appending to a StringBuilder.

      This is very error-prone. We should rewrite the code to use prepared statements instead.

      This is a large refactoring. Each bullet point below is a class/method that requires a change.

      Queries are done by:

      • query (which takes a Query object, see below)
      • queryByStatus

      These methods then call

      • queryInternal
      • which then calls findByCustomQuery

      The Query objects currently have a "getQueryString" method. We should add a new method "getPreparedStatement" in these classes:

      • org.ejbca.util.query.Query
      • BasicMatch
      • ApprovalMatch
      • TimeMatch
      • UserMach

      Since a prepared statement consists of two values
      1. a query string with ? for values
      2. a list of values
      we can not simply use a string passing around this information, we need some kind of wrapper class.

      As follow up tickets we should do the same for EndEntityAccessSessionBean.query(), the "AuthorizationString" methods in RAAuthorization etc.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              nutchas Nutcha Söderdahl
              Reporter:
              samuel Samuel Lidén Borell
              Verified by:
              Samuel Lidén Borell
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Dates

                Created:
                Updated:

                  Time Tracking

                  Estimated:
                  Original Estimate - 2 weeks
                  2w
                  Remaining:
                  Remaining Estimate - 2 weeks
                  2w
                  Logged:
                  Time Spent - Not Specified
                  Not Specified