6 lines
699 B
Plaintext
6 lines
699 B
Plaintext
$ mvn -o -B test -Dtest=SortingTest#dynamicSorting_unwhitelistedFieldRejected_whitelistedFieldWorks
|
|
(trimmed to the test's own RESULT line; the exact set-iteration order of the allowed-values list
|
|
in the exception message can vary between runs -- java.util.Set.of() makes no ordering guarantee)
|
|
|
|
RESULT[sorting-dynamic-injection-guard]: whitelist rejected 'id) --' with IllegalArgumentException ("'id) --' is not a sortable field; allowed values are [artist, title, rating]") before it ever reached the query engine | whitelisted field 'artist' produced order by s.artist -- result: [Alpha Band, Zeta Band] -- the string never touches the HQL unless it's one of the three known-safe property names.
|