validate column names of sort properties

quarkusio · Mar 21, 2020 · 0fae9a2 · 0fae9a2
1 parent 050f114
commit 0fae9a2
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 2 deletions.
diff --git a/...deployment/src/test/java/io/quarkus/hibernate/orm/panache/test/JpaOperationsSortTest.java b/...deployment/src/test/java/io/quarkus/hibernate/orm/panache/test/JpaOperationsSortTest.java
@@ -1,6 +1,7 @@
 package io.quarkus.hibernate.orm.panache.test;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 
 import org.junit.jupiter.api.Test;
 
@@ -11,8 +12,13 @@ public class JpaOperationsSortTest {
 
     @Test
     public void testSortBy() {
-        Sort sort = Sort.by("foo", "bar");
-        assertEquals(" ORDER BY foo , bar", JpaOperations.toOrderBy(sort));
+        Sort sort = Sort.by("foo", "_bar");
+        assertEquals(" ORDER BY foo , _bar", JpaOperations.toOrderBy(sort));
+    }
+
+    @Test
+    public void testInvalidSortBy() {
+        assertThrows(IllegalArgumentException.class, () -> Sort.by("foo;", "bar"));
     }
 
     @Test

diff --git a/extensions/panache/panache-common/runtime/src/main/java/io/quarkus/panache/common/Sort.java b/extensions/panache/panache-common/runtime/src/main/java/io/quarkus/panache/common/Sort.java
@@ -2,6 +2,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.regex.Pattern;
 
 /**
  * <p>
@@ -41,6 +42,8 @@ public enum Direction {
     }
 
     public class Column {
+
+        private final Pattern COLUMN_PATTERN = Pattern.compile("^[a-zA-Z_][a-zA-Z0-9_]*$");
         private String name;
         private Direction direction;
 
@@ -49,6 +52,9 @@ public Column(String name) {
         }
 
         public Column(String name, Direction direction) {
+            if (COLUMN_PATTERN.asPredicate().negate().test(name)) {
+                throw new IllegalArgumentException("Column name must match pattern: " + COLUMN_PATTERN.pattern());
+            }
             this.name = name;
             this.direction = direction;
         }