Description
Most of the Phoenix code base already uses PreparedStatements, and adds all potentially vulnerable data as parameters.
However, there are some places where we concatenate potentially problematic strings into the query.
While most of those are constants and such, we should preferably pass all data as parameters to be on the safe side.
(We still have to use dynamic strings for the preparedstatement strings, for handling things as is null, empty in clauses and such)
Spotbugs marks these with SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE, so they're easy to find.
Attachments
Issue Links
- split from
-
PHOENIX-6557 Fix code problems flagged by SpotBugs as High priority
-
- Resolved
-
- links to