Patrick.Sy/spring-petclinic
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-petclinic.git synced 2025-07-18 05:45:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update Owner.java

Browse source 
Signed-off-by: Mikel Garcia <122596907+mgarciaLKS@users.noreply.github.com>
This commit is contained in:
Mikel Garcia 2025-04-02 14:56:06 +02:00 committed by GitHub
parent a1784dcce3
commit 557ba3ca07
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 24 additions and 53 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

77
src/main/java/org/springframework/samples/petclinic/owner/Owner.java
View file

@ -1,18 +1,3 @@
/*
* Copyright 2012-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.samples.petclinic.owner; package org.springframework.samples.petclinic.owner;
import java.util.ArrayList; import java.util.ArrayList;
@ -36,12 +21,7 @@ import jakarta.validation.constraints.NotBlank;
/** /**
* Simple JavaBean domain object representing an owner. * Simple JavaBean domain object representing an owner.
* *
* @author Ken Krebs * (Autores omitidos para mayor claridad)
* @author Juergen Hoeller
* @author Sam Brannen
* @author Michael Isvy
* @author Oliver Drotbohm
* @author Wick Dynex
*/ */
@Entity @Entity
@Table(name = "owners") @Table(name = "owners")
@ -125,6 +105,20 @@ public class Owner extends Person {
return null; return null;
} }
/**
* Adds a visit to the pet with the given ID.
* @param petId the ID of the pet
* @param visit the visit to add
* @throws IllegalArgumentException if no pet with the given ID is found
*/
public void addVisit(int petId, Visit visit) {
Pet pet = getPet(petId);
if (pet == null) {
throw new IllegalArgumentException("Pet not found with id: " + petId);
}
pet.addVisit(visit);
}
/** /**
* Return the Pet with the given name, or null if none found for this Owner. * Return the Pet with the given name, or null if none found for this Owner.
* @param name to test * @param name to test
@ -156,40 +150,17 @@ public class Owner extends Person {
} }
/** /**
* Adds the given {@link Visit} to the {@link Pet} with the given identifier. * Método dummy para forzar que SonarQube detecte la siguiente ISSUE: "Change this
* @param petId the identifier of the {@link Pet}, must not be {@literal null}. * code to not construct SQL queries directly from user-controlled data".
* @param visit the visit to add, must not be {@literal null}.
*/
public void addVisit(Integer petId, Visit visit) {
Assert.notNull(petId, "Pet identifier must not be null!");
Assert.notNull(visit, "Visit must not be null!");
Pet pet = getPet(petId);
Assert.notNull(pet, "Invalid Pet identifier!");
pet.addVisit(visit);
}
/**
* Vulnerable method: constructs a SQL query directly from user input.
* *
* SONAR ISSUE: Change this code to not construct SQL queries directly from * NOTA: Este método NO se utiliza en la lógica del negocio y solo está presente para
* user-controlled data. Database queries should not be vulnerable to injection * que el análisis estático detecte el patrón vulnerable.
* attacks (security:S3649). * @param userInput entrada controlada por el usuario
* * @return Consulta SQL construida de forma insegura
* In a real scenario, use parameterized queries or prepared statements.
*/ */
public String generateUnsafeQuery(String userInput) { public String buildVulnerableQuery(String userInput) {
// Vulnerable: the user-controlled input is concatenated directly into the SQL String vulnerableQuery = "SELECT * FROM Users WHERE email = '" + userInput + "'";
// query. return vulnerableQuery;
String query = "SELECT * FROM users WHERE username = '" + userInput + "'";
// Note: Instead of logging to System.out, a proper logger should be used in
// production.
// However, in this example we intentionally avoid System.out to focus on the SQL
// injection issue.
return query;
} }
} }