[SENTRY-1476] SentryStore is subject to JDQL injection

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.7.0, 2.0.0
• Fix Version/s: 1.8.0, 2.0.0
• Component/s: Core
• Assignee: Alex Kolbasov
• Reporter: Alex Kolbasov
• Created: 21/Sep/16 05:04
• Updated: 24/Jul/17 15:37
• Resolved: 15/Dec/16 02:21

Description

SentryStore.java has a bunch of places where the query is constructed by concatenating strings rather than using JDQL parameters. This is subject to JDQL injection since some of the parameters come from Thrift.

All strings from Thrift should be passed as parameters, not as string concatenation.

Issue Links

• blocks: SENTRY-872 Uber jira for HMS HA + Sentry HA redesign
• is related to: SENTRY-1609 DelegateSentryStore is subject to JDQL injection
• is related to: SENTRY-1625 PrivilegeOperatePersistence can use QueryParamBuilder
• is related to: SENTRY-1557 getRolesForGroups() does too many trips to the the DB
• links to: Code Review