Add "slots" to sql fragments

[hechang27-sprt]

Borrowing from Vue template syntax:
Def:

<sql id="my-query">
SELECT 
<slot name="columns" />
FROM table1 JOIN table2 ON <slot name="join-cond">
<where>
AND <-- base condition 1 -->
AND <-- base condition 2 -->
<slot name="where-cond" />
</where>
ORDER BY <slot name="order-by">
</sql>

Usage:

<include refid="my-query">
<template #columns>table1.col1, col2, table2.*</template>
<template #join-cond>table1.id = table2.tbl1_key</template>
<template #order-by>table1.time DESC</template>
</include>

[hechang27-sprt]

To add to the necessity of adding such a feature, compared to ${} and property which is being way too powerful/dynamic, this syntax allow static injection of sql into <sql> fragment which reduces the attack surface of sql injection while aiding the development of static analysis tools for mybatis.

[harawata]

Hello @hechang27-sprt ,

Actually, the current <include> with properties is also static, meaning, the inclusions are resolved at the parsing phase, not at runtime.

[hechang27-sprt]

Correct me if I'm wrong, but I believe that if you write a fragment like this:

<sql>SELECT ${columns} FROM my_table</sql>

while it can be used statically with property, but there is nothing preventing you or someone else from accidentally including it in a method with a String parameter columns, or, worse, a method that receives json from front-end and indiscriminately feed it into mybatis as a map parameter, which could lead to raw string being injected directly without sanitizing.

[harawata]

I don't get it. How can that statement work then?
Are you assuming the developer releases their app without testing the statement?