escape quota instead of throwing exception

quarkusio · Apr 6, 2020 · 6d7fabb · 6d7fabb
1 parent bf5164b
commit 6d7fabb
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 8 deletions.
diff --git a/...deployment/src/test/java/io/quarkus/hibernate/orm/panache/test/JpaOperationsSortTest.java b/...deployment/src/test/java/io/quarkus/hibernate/orm/panache/test/JpaOperationsSortTest.java
@@ -13,12 +13,19 @@ public class JpaOperationsSortTest {
     @Test
     public void testSortBy() {
         Sort sort = Sort.by("foo", "_bar");
-        assertEquals(" ORDER BY foo , _bar", JpaOperations.toOrderBy(sort));
+        assertEquals(" ORDER BY 'foo' , '_bar'", JpaOperations.toOrderBy(sort));
     }
 
     @Test
-    public void testInvalidSortBy() {
-        assertThrows(IllegalArgumentException.class, () -> Sort.by("foo;", "bar"));
+    public void testInvalidSortByWithQuote() {
+        final Sort sort = Sort.by("foo'", "bar");
+        assertEquals(" ORDER BY 'foo\\'' , 'bar'", JpaOperations.toOrderBy(sort));
+    }
+
+    @Test
+    public void testInvalidSortByWithEscapeCharacters() {
+        final Sort sort = Sort.by("foo", "bar\\");
+        assertEquals(" ORDER BY 'foo' , 'bar\\\\'", JpaOperations.toOrderBy(sort));
     }
 
     @Test

diff --git a/extensions/panache/panache-common/runtime/src/main/java/io/quarkus/panache/common/Sort.java b/extensions/panache/panache-common/runtime/src/main/java/io/quarkus/panache/common/Sort.java
@@ -43,7 +43,6 @@ public enum Direction {
 
     public class Column {
 
-        private final Pattern COLUMN_PATTERN = Pattern.compile("^[a-zA-Z_][a-zA-Z0-9_]*$");
         private String name;
         private Direction direction;
 
@@ -52,10 +51,7 @@ public Column(String name) {
         }
 
         public Column(String name, Direction direction) {
-            if (COLUMN_PATTERN.asPredicate().negate().test(name)) {
-                throw new IllegalArgumentException("Column name must match pattern: " + COLUMN_PATTERN.pattern());
-            }
-            this.name = name;
+            this.name = escape(name);
             this.direction = direction;
         }
 
@@ -74,6 +70,10 @@ public Direction getDirection() {
         public void setDirection(Direction direction) {
             this.direction = direction;
         }
+
+        private String escape(String column) {
+            return "'" + column.replace("\\", "\\\\").replace("'", "\\'") + "'";
+        }
     }
 
     private List<Column> columns = new ArrayList<>();