Add SQL wildcard escaping for underscore character and custom wildcard support #7661
Conversation
![wso2-engineering[bot]](https://avatars.githubusercontent.com/in/1856828?s=60&v=4){kind=small}
| if (StringUtils.isNotBlank(attributeName) && StringUtils.isNotBlank(value) && StringUtils | ||
| .isNotBlank(operation)) { | ||
| // Escape SQL wildcards for operations that use LIKE clause. | ||
| if (operation.equals(SW) || operation.equals(EW) || operation.equals(CO)) { | ||
| value = IdentityUtil.processSingleCharWildcard(value); | ||
| } | ||
| switch (operation) { |
There was a problem hiding this comment.
Log Improvement Suggestion No: 1
| if (StringUtils.isNotBlank(attributeName) && StringUtils.isNotBlank(value) && StringUtils | |
| .isNotBlank(operation)) { | |
| // Escape SQL wildcards for operations that use LIKE clause. | |
| if (operation.equals(SW) || operation.equals(EW) || operation.equals(CO)) { | |
| value = IdentityUtil.processSingleCharWildcard(value); | |
| } | |
| switch (operation) { | |
| if (StringUtils.isNotBlank(attributeName) && StringUtils.isNotBlank(value) && StringUtils | |
| .isNotBlank(operation)) { | |
| // Escape SQL wildcards for operations that use LIKE clause. | |
| if (operation.equals(SW) || operation.equals(EW) || operation.equals(CO)) { | |
| if (LOG.isDebugEnabled()) { | |
| LOG.debug("Processing SQL wildcard escaping for operation: " + operation + ", attribute: " + attributeName); | |
| } | |
| value = IdentityUtil.processSingleCharWildcard(value); | |
| } |
| FilterData filterData = new FilterData(); | ||
|
|
||
| if (StringUtils.isBlank(filter) || filter.equals(ASTERISK)) { |
There was a problem hiding this comment.
Log Improvement Suggestion No: 3
| FilterData filterData = new FilterData(); | |
| if (StringUtils.isBlank(filter) || filter.equals(ASTERISK)) { | |
| private FilterData getFilterDataForDBQuery(String filter) throws IdentityApplicationManagementException { | |
| FilterData filterData = new FilterData(); | |
| if (log.isDebugEnabled()) { | |
| log.debug("Processing filter query: " + filter); | |
| } |
| if (FILTER_STARTS_WITH.equals(searchOperation) || FILTER_ENDS_WITH.equals(searchOperation) || | ||
| FILTER_CONTAINS.equals(searchOperation)) { | ||
| formattedFilterValue = IdentityUtil.processSingleCharWildcard(formattedFilterValue); | ||
| } |
There was a problem hiding this comment.
Log Improvement Suggestion No: 4
| if (FILTER_STARTS_WITH.equals(searchOperation) || FILTER_ENDS_WITH.equals(searchOperation) || | |
| FILTER_CONTAINS.equals(searchOperation)) { | |
| formattedFilterValue = IdentityUtil.processSingleCharWildcard(formattedFilterValue); | |
| } | |
| if (FILTER_STARTS_WITH.equals(searchOperation) || FILTER_ENDS_WITH.equals(searchOperation) || | |
| FILTER_CONTAINS.equals(searchOperation)) { | |
| formattedFilterValue = IdentityUtil.processSingleCharWildcard(formattedFilterValue); | |
| if (log.isDebugEnabled()) { | |
| log.debug("Escaped SQL wildcards for operation: " + searchOperation); | |
| } | |
| } |
| * @param value The user input value to process. | ||
| * @return The processed value with wildcard handling applied. | ||
| */ | ||
| public static String processSingleCharWildcard(String value) { |
There was a problem hiding this comment.
Log Improvement Suggestion No: 5
| public static String processSingleCharWildcard(String value) { | |
| public static String processSingleCharWildcard(String value) { | |
| log.debug("Processing single character wildcard for input value"); |
| if (StringUtils.isNotBlank(wildcardChar) && wildcardChar.length() == 1) { | ||
| escaped = escaped.replace(wildcardChar, UNDERSCORE); | ||
| } |
There was a problem hiding this comment.
Log Improvement Suggestion No: 6
| if (StringUtils.isNotBlank(wildcardChar) && wildcardChar.length() == 1) { | |
| escaped = escaped.replace(wildcardChar, UNDERSCORE); | |
| } | |
| if (StringUtils.isNotBlank(wildcardChar) && wildcardChar.length() == 1) { | |
| escaped = escaped.replace(wildcardChar, UNDERSCORE); | |
| } | |
| if (log.isDebugEnabled()) { | |
| log.debug("Processed wildcard value with wildcard character: " + wildcardChar); | |
| } |
| } else if (IdPManagementConstants.SW.equals(operation)) { | ||
| filter.append(attributeName).append(" like ? AND "); | ||
| value = IdentityUtil.processSingleCharWildcard(value); | ||
| filter.append(attributeName).append(" like ? ESCAPE '\\' AND "); | ||
| filterQueryBuilder.setFilterAttributeValue(value + "%"); |
There was a problem hiding this comment.
Log Improvement Suggestion No: 7
| } else if (IdPManagementConstants.SW.equals(operation)) { | |
| filter.append(attributeName).append(" like ? AND "); | |
| value = IdentityUtil.processSingleCharWildcard(value); | |
| filter.append(attributeName).append(" like ? ESCAPE '\\' AND "); | |
| filterQueryBuilder.setFilterAttributeValue(value + "%"); | |
| } else if (IdPManagementConstants.SW.equals(operation)) { | |
| value = IdentityUtil.processSingleCharWildcard(value); | |
| if (log.isDebugEnabled()) { | |
| log.debug("Processing SW filter for attribute: " + attributeName); | |
| } | |
| filter.append(attributeName).append(" like ? ESCAPE '\\' AND "); |
WalkthroughThis PR addresses improper handling of underscore characters in SQL LIKE queries by introducing centralized wildcard character escaping. It adds utility methods to normalize filter values, applies ESCAPE clauses to SQL statements, and introduces a configurable single-character wildcard setting across the identity management layer. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
Poem
Pre-merge checks and finishing touches❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ast-grep (0.40.0)components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.javacomponents/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.javaThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
AI Agent Log Improvement Checklist
- The log-related comments and suggestions in this review were generated by an AI tool to assist with identifying potential improvements. Purpose of reviewing the code for log improvements is to improve the troubleshooting capabilities of our products.
- Please make sure to manually review and validate all suggestions before applying any changes. Not every code suggestion would make sense or add value to our purpose. Therefore, you have the freedom to decide which of the suggestions are helpful.
✅ Before merging this pull request:
- Review all AI-generated comments for accuracy and relevance.
- Complete and verify the table below. We need your feedback to measure the accuracy of these suggestions and the value they add. If you are rejecting a certain code suggestion, please mention the reason briefly in the suggestion for us to capture it.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
components/application-mgt/org.wso2.carbon.identity.application.mgt/src/test/java/org/wso2/carbon/identity/application/mgt/ApplicationManagementServiceImplTest.java (1)
173-189: Fix DataProvider argument shape for wildcard tests; consider tightening behavior coverage.There is a hard bug in the updated DataProvider:
getAppsExcludingSystemPortalsDataProvidernow returns rows of different lengths:
- First two rows:
{ APPLICATION_NAME_FILTER_1, 1 },{ APPLICATION_NAME_FILTER_3, 0 }(2 elements).- Last two rows:
{ APPLICATION_NAME_FILTER_1, APPLICATION_FILTER_VALUE_1, 1 },{ APPLICATION_NAME_FILTER_3, APPLICATION_FILTER_VALUE_3, 0 }(3 elements).- But both consuming tests now have the signature
(String filter, String filterValue, int expectedResult):
testGetApplicationBasicInfoWithFilterExcludingSystemPortalstestGetCountOfApplicationsWithFilterExcludingSystemPortalsWith TestNG, this will fail at runtime because the first two rows don’t provide enough arguments for the method parameters.
To fix this, make all rows 3‑tuples. For example:
Suggested DataProvider fix
- private static final String APPLICATION_NAME_FILTER_3 = "name ew application3"; - private static final String APPLICATION_FILTER_VALUE_1 = "*application1"; - private static final String APPLICATION_FILTER_VALUE_3 = "*application3"; + private static final String APPLICATION_NAME_FILTER_3 = "name ew application3"; + private static final String APPLICATION_FILTER_VALUE_1 = "*application1"; + private static final String APPLICATION_FILTER_VALUE_3 = "*application3"; @@ @DataProvider(name = "getAppsExcludingSystemPortalsDataProvider") public Object[][] getAppsExcludingSystemPortals() { return new Object[][]{ - {APPLICATION_NAME_FILTER_1, 1}, - {APPLICATION_NAME_FILTER_3, 0}, - { APPLICATION_NAME_FILTER_1, APPLICATION_FILTER_VALUE_1, 1 }, - { APPLICATION_NAME_FILTER_3, APPLICATION_FILTER_VALUE_3, 0 } + // No wildcard remapping case – processSingleCharWildcard should effectively be a no-op. + { APPLICATION_NAME_FILTER_1, "application1", 1 }, + { APPLICATION_NAME_FILTER_3, "application3", 0 }, + // Custom single-character wildcard case – mapped filter values. + { APPLICATION_NAME_FILTER_1, APPLICATION_FILTER_VALUE_1, 1 }, + { APPLICATION_NAME_FILTER_3, APPLICATION_FILTER_VALUE_3, 0 } }; }This keeps your new
APPLICATION_FILTER_VALUE_*constants in use while ensuring every row matches the test method signatures.Optionally, you may also want to align the
filterstrings with the wildcard scenarios you’re trying to exercise (e.g., include the configured single‑character wildcard in the filter expression so thatIdentityUtil.processSingleCharWildcardis exercised more realistically), but that can be done in a follow‑up.Also applies to: 557-565, 601-618, 637-654
🧹 Nitpick comments (2)
components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.java (1)
3991-4012: Check interaction betweenprocessSingleCharWildcardandresolveSQLFilterfor underscore behavior.The new flow for
sw/ew/cois:
- Build a
*-based mask (e.g.,"*value*").- Run
IdentityUtil.processSingleCharWildcard(formattedFilterValue).- Later, run
resolveSQLFilter, which converts* → %and? → _.Based on the provided summary of
IdentityUtil.processSingleCharWildcard(String value)(escaping underscores and mapping the configuredSINGLE_CHARACTER_WILDCARDto_when it is a non‑blank, non‑"_"character), this should:
- Allow a configurable single‑character wildcard.
- Escape literal underscores when the wildcard is configured to something else, so that
ESCAPE '\'works as intended.However, when
SINGLE_CHARACTER_WILDCARDremains the default"_", the helper is described as returning the value unchanged, meaning underscores insearchValuewill still act as SQL wildcards afterresolveSQLFilterhas turned*into%. If the product expectation is that underscores in search inputs stop behaving as wildcards without requiring an admin to changeSINGLE_CHARACTER_WILDCARD, this may not fully address the original issue.Please double‑check, with unit/integration tests, that for both:
- default
SINGLE_CHARACTER_WILDCARDconfiguration, and- a non‑underscore custom wildcard (e.g.
?),the composed pattern (after
processSingleCharWildcard+resolveSQLFilter) and theLIKE ... ESCAPE '\'clause yield the intended behavior for names containing underscores, and update docs if a config change is required to get non‑wildcard underscores.
Based on learnings from the providedIdentityUtil.processSingleCharWildcardsummary.components/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.java (1)
120-128: Clarify SINGLE_CHARACTER_WILDCARD defaults vsprocessSingleCharWildcardbehavior.The implementation behavior is:
- If
valueis blank → return as is.- If
wildcardCharequals"_"→ returnvalueunchanged, so_remains a SQL single‑char wildcard.- If
wildcardCharisnull/blank or any non‑"_":
- All existing
_are escaped to\_(with laterESCAPE '\').- If
wildcardCharis a single non‑blank character, its occurrences are mapped to_, making that character the logical single‑char wildcard.This is internally consistent, but the Javadoc currently states that
"_"is the default and acts as a wildcard, while the “no config / empty config” case effectively makes_literal (escaped). Given the PR goal is to fix underscore search behavior, please double‑check:
- What value is actually configured by default for
SINGLE_CHARACTER_WILDCARDinidentity.xml/ related config.- Whether the Javadoc should explicitly describe the “property absent/blank” case as the default behavior (escaping
_), with"_"being an opt‑in for legacy wildcard semantics.Adjusting either the docs or the default config to match the intended product behavior would avoid confusion for operators.
Also applies to: 2377-2401
📜 Review details
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (8)
components/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/util/FilterQueriesUtil.javacomponents/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.javacomponents/application-mgt/org.wso2.carbon.identity.application.mgt/src/test/java/org/wso2/carbon/identity/application/mgt/ApplicationManagementServiceImplTest.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityCoreConstants.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.javacomponents/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.javafeatures/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.json
🧰 Additional context used
📓 Path-based instructions (6)
**/*.{py,java,ts,tsx,js,jsx,cs,go,rb,php}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
All public methods should have a docstring
Files:
components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityCoreConstants.javacomponents/application-mgt/org.wso2.carbon.identity.application.mgt/src/test/java/org/wso2/carbon/identity/application/mgt/ApplicationManagementServiceImplTest.javacomponents/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.javacomponents/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/util/FilterQueriesUtil.java
**/*.{py,java,ts,tsx,js,jsx,cs,go,rb,php,c,cpp,h,hpp}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{py,java,ts,tsx,js,jsx,cs,go,rb,php,c,cpp,h,hpp}: Comments should start with a space and first letter capitalized
Comments should always end with a period
Files:
components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityCoreConstants.javacomponents/application-mgt/org.wso2.carbon.identity.application.mgt/src/test/java/org/wso2/carbon/identity/application/mgt/ApplicationManagementServiceImplTest.javacomponents/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.javacomponents/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/util/FilterQueriesUtil.java
**/*.java
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.java: If there's a string concatenation in a debug log, then havingif (LOG.isDebugEnabled())is mandatory to avoid unnecessary computation
For simple log messages (e.g., static strings or simple variable interpolation), you can useLOG.debugdirectly without the debug check
Files:
components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityCoreConstants.javacomponents/application-mgt/org.wso2.carbon.identity.application.mgt/src/test/java/org/wso2/carbon/identity/application/mgt/ApplicationManagementServiceImplTest.javacomponents/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.javacomponents/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/util/FilterQueriesUtil.java
**/*.{java,ts,tsx,js,jsx,py,cs,go,php}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
**/*.{java,ts,tsx,js,jsx,py,cs,go,php}: Scrutinize all user-controlled input for potential SQL Injection, Cross-Site Scripting (XSS), or Command Injection
Ensure that no sensitive user data (e.g., PII, credentials) is being logged or sent in error messages
Files:
components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityCoreConstants.javacomponents/application-mgt/org.wso2.carbon.identity.application.mgt/src/test/java/org/wso2/carbon/identity/application/mgt/ApplicationManagementServiceImplTest.javacomponents/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.javacomponents/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/util/FilterQueriesUtil.java
**/*.{java,ts,tsx,js,jsx,py,cs,go,php,yml,yaml,json,env,properties,conf}
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Search for and eliminate any exposed secrets like API keys, passwords, or private tokens
Files:
components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.javacomponents/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityCoreConstants.javafeatures/identity-core/org.wso2.carbon.identity.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.jsoncomponents/application-mgt/org.wso2.carbon.identity.application.mgt/src/test/java/org/wso2/carbon/identity/application/mgt/ApplicationManagementServiceImplTest.javacomponents/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.javacomponents/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/util/FilterQueriesUtil.java
**/*{DAO,Repository,Dao,dao}.java
📄 CodeRabbit inference engine (.github/copilot-instructions.md)
All database queries should support the following database types: DB2, H2, MS SQL Server, MySQL, Oracle, and PostgreSQL
Files:
components/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.java
🧬 Code graph analysis (4)
components/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.java (1)
components/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityCoreConstants.java (1)
IdentityCoreConstants(23-176)
components/application-mgt/org.wso2.carbon.identity.application.mgt/src/test/java/org/wso2/carbon/identity/application/mgt/ApplicationManagementServiceImplTest.java (1)
components/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.java (1)
IdentityUtil(131-2402)
components/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.java (2)
components/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.java (1)
IdentityUtil(131-2402)components/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/util/IdPManagementConstants.java (1)
IdPManagementConstants(28-753)
components/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/util/FilterQueriesUtil.java (2)
components/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityUtil.java (1)
IdentityUtil(131-2402)components/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/constant/APIResourceManagementConstants.java (1)
APIResourceManagementConstants(28-237)
🔇 Additional comments (11)
features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/org.wso2.carbon.identity.core.server.feature.default.json (1)
2187-2188: LGTM: Configuration for wildcard escaping added correctly.The new configuration key
api.filters.single_character_wildcardwith an empty string default is appropriate. This allows underscore characters to be escaped in SQL LIKE queries by default, while providing flexibility to configure a custom single-character wildcard if needed.components/identity-core/org.wso2.carbon.identity.core/src/main/java/org/wso2/carbon/identity/core/util/IdentityCoreConstants.java (2)
2-4: LGTM: License header updated.Standard copyright and organization information update with no functional impact.
39-40: Verify configuration key naming convention forSINGLE_CHARACTER_WILDCARDconstant.The constant
SINGLE_CHARACTER_WILDCARD = "APIFiltering.SingleCharacterWildcard"uses camelCase, but the code comment at line 2378 referencesapi.filters.single_character_wildcard(snake_case). Confirm whether the constant value should match the configuration key format used inidentity.xmland whether the comment reflects the intended configuration property name.features/identity-core/org.wso2.carbon.identity.core.server.feature/resources/identity.xml.j2 (2)
4-18: License header year bump looks correctApache 2.0 header is intact and the year range update to 2019‑2025 is consistent with the rest of the codebase’s style.
5022-5025: APIFiltering block wiring looks good; verify default and docsThe new
<APIFiltering>section and{{api.filters.single_character_wildcard}}binding follow existing template patterns and placement near other API-related flags makes sense. Please just confirm that:
api.filters.single_character_wildcardis always defined in the default config (and migration paths), and- The new
[api.filters] single_character_wildcardoption is documented with its default and semantics (literal vs wildcard behavior) so operators know how to use it.If those are already covered, this fragment is good to go.
components/idp-mgt/org.wso2.carbon.idp.mgt/src/main/java/org/wso2/carbon/idp/mgt/dao/IdPManagementDAO.java (2)
2-16: Header year and organization update is fineCopyright holder/year and license header formatting remain consistent with the rest of the codebase.
1004-1019: Wildcard escaping inappendFilterQuerylooks correct; please verify across all DBs
- Applying
IdentityUtil.processSingleCharWildcard(value)forsw/ew/cobefore building the LIKE pattern centralizes single‑char wildcard handling (including underscore and backslash) and aligns this DAO with the new config‑driven behavior.- Adding
ESCAPE '\\'to the LIKE fragments ensures that\_(and escaped\) behave consistently as literals when a non‑underscore single‑character wildcard is configured.- Parameters are still bound via
PreparedStatement(no interpolation of user values into SQL), so there’s no SQL‑injection risk introduced.Please run or extend tests against all supported DBs (MySQL/MariaDB, H2, Oracle, MSSQL, PostgreSQL, DB2, Informix) to confirm that
LIKE ... ESCAPE '\'behaves as expected in each dialect, especially whensingle_character_wildcardis customized away from_.components/application-mgt/org.wso2.carbon.identity.application.mgt/src/main/java/org/wso2/carbon/identity/application/mgt/dao/impl/ApplicationDAOImpl.java (3)
2-2: Copyright year update is fine.The year range extension to 2014–2025 is consistent with current changes; no functional impact.
3912-3927: Consistent use ofESCAPE '\'in simple app-name filters looks correct; verify across DBs.Using
"SP_APP.APP_NAME LIKE ? ESCAPE '\\'"in the blank/*and simple-name-with-asterisk paths aligns these cases with the more advanced filter handling and supports literal escaping of the configured single‑character wildcard. Since this feeds into vendor‑specific queries viaString.format, and values are still bound as parameters, there is no added SQL injection risk.Please confirm via tests that all supported DBs (MySQL/MariaDB/H2, Oracle, MSSQL, PostgreSQL, DB2, Informix) accept the
ESCAPE '\'clause in these templates and behave the same as the existing attribute-based LIKE filters.
3970-3987: AddingESCAPE '\'to attribute-based LIKE filters is aligned with the new wildcard model.For non‑
eqoperations (sw,ew,co), switching torealSearchField + " LIKE ? ESCAPE '\\'"ensures that all LIKE clauses use the same escape semantics as the simple app-name filters and can rely onIdentityUtil.processSingleCharWildcardto prepare values.Given this impacts OAuth client ID / SAML issuer filters as well, please verify that existing filters with configured single‑character wildcards and literal underscores still behave as expected after this change.
components/api-resource-mgt/org.wso2.carbon.identity.api.resource.mgt/src/main/java/org/wso2/carbon/identity/api/resource/mgt/util/FilterQueriesUtil.java (1)
126-131: LIKE wildcard preprocessing and ESCAPE usage look correct.Limiting
IdentityUtil.processSingleCharWildcardto SW/EW/CO before building the filter and appendingESCAPE '\'to all LIKE clauses is a clean way to centralize single‑char wildcard handling while keeping parameters bound safely via?. The switch refactor to use static operator constants is also fine.Also applies to: 143-157, 158-177, 205-227
1 participant
Purpose
$subject
Resolves: wso2/product-is#26137
Add the below config to enable this:
Before:
After:
Summary by CodeRabbit
New Features
Bug Fixes
✏️ Tip: You can customize this high-level summary in your review settings.