[GROOVY-9295] Sql.checkForNamedParams false positives

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.4.15
• Component/s: SQL processing
• Environment: Grails 3.2.4
• Assignee: Unassigned
• Reporter: Andreas
• Created: 30/Oct/19 10:49
• Updated: 30/Oct/19 10:49

Description

The public function 

{{checkForNamedParams }}

(used in getPreparedStatement)  detects named parameters with a regex via

ExtractIndexAndSql.hasNamedParameters

This regex matches not only named params (:xxx) but also sql casts ('xxx'::text) which in turn results in sql errrs when called with

sql.eachRow(query, args, closure)

 

{{when }}

{{a. query includes a cast but no named parameters and }}

b. args contains  Map with named parameters

Test case:

sql.eachRow("select 1,2,3::text", ["a": "b"], {{{

{ row -> println row as String}

)}}

error when sql points to postgres: no hstore extension installed