packages/hibernate3
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

!3 fix CVE-2020-25638

Browse Source 
From: @zhangtao2020
Reviewed-by: @wangchong1995924
Signed-off-by: @wangchong1995924
This commit is contained in:
openeuler-ci-bot 2020-12-14 15:54:40 +08:00 committed by Gitee
commit 505963ea2b
2 changed files with 376 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

371
CVE-2020-25638.patch Normal file
View File

@ -0,0 +1,371 @@
From 29aa6dd125fd0d5dba5f525cfa718155c3120b1a Mon Sep 17 00:00:00 2001
From: zhangtao2020 <18066722603@163.com>
Date: Sat, 12 Dec 2020 17:15:13 +0800
Subject: [PATCH] CVE-2020-25638
---
.../java/org/hibernate/dialect/Dialect.java | 11 ++
.../main/java/org/hibernate/sql/Delete.java | 4 +-
.../main/java/org/hibernate/sql/Insert.java | 2 +-
.../java/org/hibernate/sql/InsertSelect.java | 2 +-
.../java/org/hibernate/sql/QuerySelect.java | 2 +-
.../main/java/org/hibernate/sql/Select.java | 2 +-
.../java/org/hibernate/sql/SimpleSelect.java | 2 +-
.../main/java/org/hibernate/sql/Update.java | 2 +-
.../hibernate/test/comments/TestEntity.java | 46 ++++++++
.../hibernate/test/comments/TestEntity2.java | 37 ++++++
.../test/comments/UseSqlCommentTest.java | 111 ++++++++++++++++++
11 files changed, 214 insertions(+), 7 deletions(-)
create mode 100644 hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity.java
create mode 100644 hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity2.java
create mode 100644 hibernate-core/src/test/java/org/hibernate/test/comments/UseSqlCommentTest.java
diff --git a/hibernate-core/src/main/java/org/hibernate/dialect/Dialect.java b/hibernate-core/src/main/java/org/hibernate/dialect/Dialect.java
index 1b0c776..d9ee9e6 100644
--- a/hibernate-core/src/main/java/org/hibernate/dialect/Dialect.java
+++ b/hibernate-core/src/main/java/org/hibernate/dialect/Dialect.java
@@ -36,6 +36,7 @@ import java.util.List;
import java.util.Map;
import java.util.Properties;
import java.util.Set;
+import java.util.regex.Pattern;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -108,6 +109,9 @@ public abstract class Dialect {
private static final Set<BasicType> streamBindingLobTypes = new HashSet<BasicType>();
+ private static final Pattern ESCAPE_CLOSING_COMMENT_PATTERN = Pattern.compile( "\\*/" );
+ private static final Pattern ESCAPE_OPENING_COMMENT_PATTERN = Pattern.compile( "/\\*" );
+
static {
// Blobs
streamBindingLobTypes.add( BlobType.INSTANCE.getAlternatives().getStreamBindingType() );
@@ -1998,4 +2002,11 @@ public abstract class Dialect {
// oddly most database in fact seem to, so true is the default.
return true;
}
+ public static String escapeComment(String comment) {
+ if ( StringHelper.isNotEmpty( comment ) ) {
+ final String escaped = ESCAPE_CLOSING_COMMENT_PATTERN.matcher( comment ).replaceAll( "*\\\\/" );
+ return ESCAPE_OPENING_COMMENT_PATTERN.matcher( escaped ).replaceAll( "/\\\\*" );
+ }
+ return comment;
+ }
}
diff --git a/hibernate-core/src/main/java/org/hibernate/sql/Delete.java b/hibernate-core/src/main/java/org/hibernate/sql/Delete.java
index 6ec17cc..cf22d4b 100644
--- a/hibernate-core/src/main/java/org/hibernate/sql/Delete.java
+++ b/hibernate-core/src/main/java/org/hibernate/sql/Delete.java
@@ -28,6 +28,8 @@ import java.util.Iterator;
import java.util.LinkedHashMap;
import java.util.Map;
+import org.hibernate.dialect.Dialect;
+
/**
* An SQL <tt>DELETE</tt> statement
*
@@ -55,7 +57,7 @@ public class Delete {
public String toStatementString() {
StringBuffer buf = new StringBuffer( tableName.length() + 10 );
if ( comment!=null ) {
- buf.append( "/* " ).append(comment).append( " */ " );
+ buf.append( "/* " ).append( Dialect.escapeComment(comment)).append( " */ " );
}
buf.append( "delete from " ).append(tableName);
if ( where != null || !primaryKeyColumns.isEmpty() || versionColumnName != null ) {
diff --git a/hibernate-core/src/main/java/org/hibernate/sql/Insert.java b/hibernate-core/src/main/java/org/hibernate/sql/Insert.java
index 5d8e232..7672654 100644
--- a/hibernate-core/src/main/java/org/hibernate/sql/Insert.java
+++ b/hibernate-core/src/main/java/org/hibernate/sql/Insert.java
@@ -109,7 +109,7 @@ public class Insert {
public String toStatementString() {
StringBuffer buf = new StringBuffer( columns.size()*15 + tableName.length() + 10 );
if ( comment != null ) {
- buf.append( "/* " ).append( comment ).append( " */ " );
+ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " );
}
buf.append("insert into ")
.append(tableName);
diff --git a/hibernate-core/src/main/java/org/hibernate/sql/InsertSelect.java b/hibernate-core/src/main/java/org/hibernate/sql/InsertSelect.java
index 69a54ea..4887fea 100644
--- a/hibernate-core/src/main/java/org/hibernate/sql/InsertSelect.java
+++ b/hibernate-core/src/main/java/org/hibernate/sql/InsertSelect.java
@@ -81,7 +81,7 @@ public class InsertSelect {
StringBuffer buf = new StringBuffer( (columnNames.size() * 15) + tableName.length() + 10 );
if ( comment!=null ) {
- buf.append( "/* " ).append( comment ).append( " */ " );
+ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " );
}
buf.append( "insert into " ).append( tableName );
if ( !columnNames.isEmpty() ) {
diff --git a/hibernate-core/src/main/java/org/hibernate/sql/QuerySelect.java b/hibernate-core/src/main/java/org/hibernate/sql/QuerySelect.java
index f019782..822444c 100644
--- a/hibernate-core/src/main/java/org/hibernate/sql/QuerySelect.java
+++ b/hibernate-core/src/main/java/org/hibernate/sql/QuerySelect.java
@@ -135,7 +135,7 @@ public class QuerySelect {
public String toQueryString() {
StringBuffer buf = new StringBuffer(50);
- if (comment!=null) buf.append("/* ").append(comment).append(" */ ");
+ if (comment!=null) buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " );
buf.append("select ");
if (distinct) buf.append("distinct ");
String from = joins.toFromFragmentString();
diff --git a/hibernate-core/src/main/java/org/hibernate/sql/Select.java b/hibernate-core/src/main/java/org/hibernate/sql/Select.java
index 9a52cd4..63ef866 100644
--- a/hibernate-core/src/main/java/org/hibernate/sql/Select.java
+++ b/hibernate-core/src/main/java/org/hibernate/sql/Select.java
@@ -59,7 +59,7 @@ public class Select {
public String toStatementString() {
StringBuffer buf = new StringBuffer(guesstimatedBufferSize);
if ( StringHelper.isNotEmpty(comment) ) {
- buf.append("/* ").append(comment).append(" */ ");
+ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " );
}
buf.append("select ").append(selectClause)
diff --git a/hibernate-core/src/main/java/org/hibernate/sql/SimpleSelect.java b/hibernate-core/src/main/java/org/hibernate/sql/SimpleSelect.java
index 5035eeb..cca2d65 100644
--- a/hibernate-core/src/main/java/org/hibernate/sql/SimpleSelect.java
+++ b/hibernate-core/src/main/java/org/hibernate/sql/SimpleSelect.java
@@ -156,7 +156,7 @@ public class SimpleSelect {
);
if ( comment!=null ) {
- buf.append("/* ").append(comment).append(" */ ");
+ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " );
}
buf.append("select ");
diff --git a/hibernate-core/src/main/java/org/hibernate/sql/Update.java b/hibernate-core/src/main/java/org/hibernate/sql/Update.java
index 400fe7c..b8ea145 100644
--- a/hibernate-core/src/main/java/org/hibernate/sql/Update.java
+++ b/hibernate-core/src/main/java/org/hibernate/sql/Update.java
@@ -181,7 +181,7 @@ public class Update {
public String toStatementString() {
StringBuffer buf = new StringBuffer( (columns.size() * 15) + tableName.length() + 10 );
if ( comment!=null ) {
- buf.append( "/* " ).append( comment ).append( " */ " );
+ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " );
}
buf.append( "update " ).append( tableName ).append( " set " );
boolean assignmentsAppended = false;
diff --git a/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity.java b/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity.java
new file mode 100644
index 0000000..7c425be
--- /dev/null
+++ b/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity.java
@@ -0,0 +1,46 @@
+/*
+ * Hibernate, Relational Persistence for Idiomatic Java
+ *
+ * License: GNU Lesser General Public License (LGPL), version 2.1 or later.
+ * See the lgpl.txt file in the root directory or <http://www.gnu.org/licenses/lgpl-2.1.html>.
+ */
+package org.hibernate.test.comments;
+
+import javax.persistence.Entity;
+import javax.persistence.Id;
+
+/**
+ * @author Andrea Boriero
+ */
+@Entity
+public class TestEntity {
+ @Id
+ private String id;
+
+ private String value;
+
+ public TestEntity() {
+
+ }
+
+ public TestEntity(String id, String value) {
+ this.id = id;
+ this.value = value;
+ }
+
+ public String getId() {
+ return id;
+ }
+
+ public void setId(String id) {
+ this.id = id;
+ }
+
+ public String getValue() {
+ return value;
+ }
+
+ public void setValue(String value) {
+ this.value = value;
+ }
+}
diff --git a/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity2.java b/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity2.java
new file mode 100644
index 0000000..58b626d
--- /dev/null
+++ b/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity2.java
@@ -0,0 +1,37 @@
+/*
+ * Hibernate, Relational Persistence for Idiomatic Java
+ *
+ * License: GNU Lesser General Public License (LGPL), version 2.1 or later.
+ * See the lgpl.txt file in the root directory or <http://www.gnu.org/licenses/lgpl-2.1.html>.
+ */
+package org.hibernate.test.comments;
+
+import javax.persistence.Entity;
+import javax.persistence.Id;
+
+/**
+ * @author Andrea Boriero
+ */
+@Entity
+public class TestEntity2 {
+ @Id
+ private String id;
+
+ private String value;
+
+ public String getId() {
+ return id;
+ }
+
+ public void setId(String id) {
+ this.id = id;
+ }
+
+ public String getValue() {
+ return value;
+ }
+
+ public void setValue(String value) {
+ this.value = value;
+ }
+}
diff --git a/hibernate-core/src/test/java/org/hibernate/test/comments/UseSqlCommentTest.java b/hibernate-core/src/test/java/org/hibernate/test/comments/UseSqlCommentTest.java
new file mode 100644
index 0000000..2bd6adf
--- /dev/null
+++ b/hibernate-core/src/test/java/org/hibernate/test/comments/UseSqlCommentTest.java
@@ -0,0 +1,111 @@
+/*
+ * Hibernate, Relational Persistence for Idiomatic Java
+ *
+ * License: GNU Lesser General Public License (LGPL), version 2.1 or later.
+ * See the lgpl.txt file in the root directory or <http://www.gnu.org/licenses/lgpl-2.1.html>.
+ */
+package org.hibernate.test.comments;
+
+import java.util.List;
+import java.util.Map;
+import javax.persistence.EntityManager;
+import javax.persistence.TypedQuery;
+import javax.persistence.criteria.CompoundSelection;
+import javax.persistence.criteria.CriteriaBuilder;
+import javax.persistence.criteria.CriteriaQuery;
+import javax.persistence.criteria.Path;
+import javax.persistence.criteria.Root;
+
+import org.hibernate.cfg.AvailableSettings;
+import org.hibernate.jpa.test.BaseEntityManagerFunctionalTestCase;
+
+import org.junit.Before;
+import org.junit.Test;
+
+import static org.hamcrest.CoreMatchers.is;
+import static org.hibernate.testing.transaction.TransactionUtil.doInJPA;
+import static org.junit.Assert.assertThat;
+
+/**
+ * @author Andrea Boriero
+ */
+public class UseSqlCommentTest extends BaseEntityManagerFunctionalTestCase {
+
+ @Override
+ protected Class<?>[] getAnnotatedClasses() {
+ return new Class[] { TestEntity.class, TestEntity2.class };
+ }
+
+ @Override
+ protected void addMappings(Map settings) {
+ settings.put( AvailableSettings.USE_SQL_COMMENTS, "true" );
+ settings.put( AvailableSettings.FORMAT_SQL, "false" );
+ }
+
+ @Before
+ public void setUp() {
+ doInJPA( this::entityManagerFactory, entityManager -> {
+ TestEntity testEntity = new TestEntity();
+ testEntity.setId( "test1" );
+ testEntity.setValue( "value1" );
+ entityManager.persist( testEntity );
+
+ TestEntity2 testEntity2 = new TestEntity2();
+ testEntity2.setId( "test2" );
+ testEntity2.setValue( "value2" );
+ entityManager.persist( testEntity2 );
+ } );
+ }
+
+ @Test
+ public void testIt() {
+ String appendLiteral = "*/select id as col_0_0_,value as col_1_0_ from testEntity2 where 1=1 or id=?--/*";
+ doInJPA( this::entityManagerFactory, entityManager -> {
+
+ List<TestEntity> result = findUsingQuery( "test1", appendLiteral, entityManager );
+
+ TestEntity test1 = result.get( 0 );
+ assertThat( test1.getValue(), is( appendLiteral ) );
+ } );
+
+ doInJPA( this::entityManagerFactory, entityManager -> {
+
+ List<TestEntity> result = findUsingCriteria( "test1", appendLiteral, entityManager );
+
+ TestEntity test1 = result.get( 0 );
+ assertThat( test1.getValue(), is( appendLiteral ) );
+ } );
+ }
+
+ public List<TestEntity> findUsingCriteria(String id, String appendLiteral, EntityManager entityManager) {
+ CriteriaBuilder builder = entityManager.getCriteriaBuilder();
+ CriteriaQuery<TestEntity> criteria = builder.createQuery( TestEntity.class );
+ Root<TestEntity> root = criteria.from( TestEntity.class );
+
+ Path<Object> idPath = root.get( "id" );
+ CompoundSelection<TestEntity> selection = builder.construct(
+ TestEntity.class,
+ idPath,
+ builder.literal( appendLiteral )
+ );
+ criteria.select( selection );
+
+ criteria.where( builder.equal( idPath, builder.parameter( String.class, "where_id" ) ) );
+
+ TypedQuery<TestEntity> query = entityManager.createQuery( criteria );
+ query.setParameter( "where_id", id );
+ return query.getResultList();
+ }
+
+ public List<TestEntity> findUsingQuery(String id, String appendLiteral, EntityManager entityManager) {
+ TypedQuery<TestEntity> query =
+ entityManager.createQuery(
+ "select new org.hibernate.test.comments.TestEntity(id, '"
+ + appendLiteral.replace( "'", "''" )
+ + "') from TestEntity where id=:where_id",
+ TestEntity.class
+ );
+ query.setParameter( "where_id", id );
+ return query.getResultList();
+ }
+}
--
2.27.0

6
hibernate3.spec
View File

@ -1,6 +1,6 @@
Name: hibernate3
Version: 3.6.10
Release: 23
Release: 24
Summary: Inquiry service and persistence of releationship
License: LGPLv2+
URL: http://www.hibernate.org/
@ -9,6 +9,7 @@ URL: http://www.hibernate.org/
Source0: hibernate-orm-3.6.10.Final.tar.xz
Patch0000: hibernate-orm-fix-jacc-gid-aid.patch
Patch0001: hibernate-orm-cglib-3.1.patch
Patch0002: CVE-2020-25638.patch
BuildArch: noarch
@ -155,5 +156,8 @@ export LANG=en_US.UTF-8
%license lgpl.txt
%changelog
* Sat Dec 12 2020 zhangtao <zhangtao221@huawei.com> - 3.6.10-24
- CVE-2020-25638
* Mon Feb 24 2020 wutao <wutao61@huawei.com> - 3.6.10-23
- Package init