Query: add SQL string with parameters

dao/src/main/java/org/thingsboard/server/dao/sql/query/DefaultQueryLogComponent.java

@@ -54,7 +54,6 @@ public class DefaultQueryLogComponent implements QueryLogComponent {
 
         ParsedSql parsedSql = NamedParameterUtils.parseSqlStatement(sql);
         List<SqlParameter> declaredParams = NamedParameterUtils.buildSqlParameterList(parsedSql, paramSource);
-        StringBuilder actualSql = new StringBuilder(parsedSql.toString());
 
         if (declaredParams.isEmpty()) {
             return sql;
@@ -74,8 +73,7 @@ public class DefaultQueryLogComponent implements QueryLogComponent {
             if (!(value instanceof Iterable)) {
 
                 String ValueForSQLQuery = getValueForSQLQuery(value);
-                String sqlTemp = sql.replace(":" + paramName, ValueForSQLQuery);
+                sql = sql.replace(":" + paramName, ValueForSQLQuery);
-                sql = sqlTemp;
                 continue;
             }
 
@@ -94,10 +92,8 @@ public class DefaultQueryLogComponent implements QueryLogComponent {
                 ++count;
             }
 
-            if (!valueArrayStr.isEmpty()){
+            sql = sql.replace(":" + paramName, valueArrayStr);
-                String sqlTemp = sql.replace(":" + paramName, valueArrayStr);
+
-                sql = sqlTemp;
-            }
         }
 
         return sql;
@@ -106,11 +102,11 @@ public class DefaultQueryLogComponent implements QueryLogComponent {
     String getValueForSQLQuery(Object valueParameter) {
 
         if (valueParameter instanceof String) {
-            return "'" + valueParameter + "'";
+            return "'" + ((String) valueParameter).replaceAll("'", "''") + "'";
         }
 
         if (valueParameter instanceof UUID) {
-            return "'" + valueParameter.toString() + "'";
+            return "'" + valueParameter + "'";
         }
 
         return valueParameter.toString();

dao/src/test/java/org/thingsboard/server/dao/sql/query/DefaultQueryLogComponentTest.java

@@ -2,15 +2,14 @@
 package org.thingsboard.server.dao.sql.query;
 
 import com.datastax.oss.driver.api.core.uuid.Uuids;
-import org.junit.jupiter.api.BeforeEach;
+import org.junit.Before;
-import org.junit.jupiter.api.Test;
+import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.context.junit4.SpringRunner;
 import org.thingsboard.server.common.data.EntityType;
 import org.thingsboard.server.common.data.id.TenantId;
-
 import java.util.ArrayList;
 import java.util.List;
 import java.util.UUID;
@@ -19,7 +18,7 @@ import static org.junit.Assert.assertEquals;
 
 @RunWith(SpringRunner.class)
 @SpringBootTest(classes = DefaultQueryLogComponent.class)
-class DefaultQueryLogComponentTest {
+public class DefaultQueryLogComponentTest {
 
     private TenantId tenantId;
     private QueryContext ctx;
@@ -27,44 +26,44 @@ class DefaultQueryLogComponentTest {
     @Autowired
     private DefaultQueryLogComponent queryLog;
 
-    @BeforeEach
+    @Before
-    void setUp() {
+    public void setUp() {
         tenantId = new TenantId(Uuids.timeBased());
         ctx = new QueryContext(new QuerySecurityContext(tenantId, null, EntityType.ALARM));
     }
 
     @Test
-    void substituteParametersInSqlString_StringType() {
+    public void substituteParametersInSqlString_StringType() {
 
-        String Name = "Mery";
+        String Name = "Mery's";
         String id = "ID_1";
         String sql = "Select * from Table Where name = :name AND id = :id";
-        String sqlToUse = "Select * from Table Where name = 'Mery' AND id = 'ID_1'";
+        String sqlToUse = "Select * from Table Where name = 'Mery''s' AND id = 'ID_1'";
 
         ctx.addStringParameter("name", Name);
         ctx.addStringParameter("id", id);
 
-        String sqlToUse2 = queryLog.substituteParametersInSqlString(sql, ctx);
+        String sqlToUseResult = queryLog.substituteParametersInSqlString(sql, ctx);
-        assertEquals(sqlToUse, sqlToUse2);
+        assertEquals(sqlToUse, sqlToUseResult);
     }
 
     @Test
-    void substituteParametersInSqlString_DoubleLongType() {
+    public void substituteParametersInSqlString_DoubleLongType() {
 
-        double sum = 10.55;
+        double sum = 0.00000021d;
         long price = 100000;
         String sql = "Select * from Table Where sum = :sum AND price = :price";
-        String sqlToUse = "Select * from Table Where sum = 10.55 AND price = 100000";
+        String sqlToUse = "Select * from Table Where sum = 2.1E-7 AND price = 100000";
 
         ctx.addDoubleParameter("sum", sum);
         ctx.addLongParameter("price", price);
 
-        String sqlToUse2 = queryLog.substituteParametersInSqlString(sql, ctx);
+        String sqlToUseResult = queryLog.substituteParametersInSqlString(sql, ctx);
-        assertEquals(sqlToUse, sqlToUse2);
+        assertEquals(sqlToUse, sqlToUseResult);
     }
 
     @Test
-    void substituteParametersInSqlString_BooleanType() {
+    public void substituteParametersInSqlString_BooleanType() {
 
         boolean check = true;
         String sql = "Select * from Table Where check = :check AND mark = :mark";
@@ -73,43 +72,39 @@ class DefaultQueryLogComponentTest {
         ctx.addBooleanParameter("check", check);
         ctx.addBooleanParameter("mark", false);
 
-        String sqlToUse2 = queryLog.substituteParametersInSqlString(sql, ctx);
+        String sqlToUseResult = queryLog.substituteParametersInSqlString(sql, ctx);
-        assertEquals(sqlToUse, sqlToUse2);
+        assertEquals(sqlToUse, sqlToUseResult);
     }
 
     @Test
-    void substituteParametersInSqlString_UuidType() {
+    public void substituteParametersInSqlString_UuidType() {
 
         UUID guid = Uuids.timeBased();
         String sql = "Select * from Table Where guid = :guid";
-        String sqlToUse = "Select * from Table Where guid = '" + guid.toString() + "'";
+        String sqlToUse = "Select * from Table Where guid = '" + guid + "'";
 
         ctx.addUuidParameter("guid", guid);
 
-        String sqlToUse2 = queryLog.substituteParametersInSqlString(sql, ctx);
+        String sqlToUseResult = queryLog.substituteParametersInSqlString(sql, ctx);
-        assertEquals(sqlToUse, sqlToUse2);
+        assertEquals(sqlToUse, sqlToUseResult);
     }
 
     @Test
-    void substituteParametersInSqlString_StringListType() {
+    public void substituteParametersInSqlString_StringListType() {
 
-        List<String> ids = new ArrayList<>();
+        List<String> ids = List.of("ID_1'", "ID_2", "ID_3", "ID_4");
-        ids.add("ID_1");
-        ids.add("ID_2");
-        ids.add("ID_3");
-        ids.add("ID_4");
 
         String sql = "Select * from Table Where id IN (:ids)";
-        String sqlToUse = "Select * from Table Where id IN ('ID_1', 'ID_2', 'ID_3', 'ID_4')";
+        String sqlToUse = "Select * from Table Where id IN ('ID_1''', 'ID_2', 'ID_3', 'ID_4')";
 
         ctx.addStringListParameter("ids", ids);
 
-        String sqlToUse2 = queryLog.substituteParametersInSqlString(sql, ctx);
+        String sqlToUseResult = queryLog.substituteParametersInSqlString(sql, ctx);
-        assertEquals(sqlToUse, sqlToUse2);
+        assertEquals(sqlToUse, sqlToUseResult);
     }
 
     @Test
-    void substituteParametersInSqlString_UuidListType() {
+    public void substituteParametersInSqlString_UuidListType() {
 
         List<UUID> guids = new ArrayList<>();
         guids.add(UUID.fromString("634a8d03-6871-4e01-94d0-876bf3e67dff"));
@@ -121,8 +116,8 @@ class DefaultQueryLogComponentTest {
 
         ctx.addUuidListParameter("guids", guids);
 
-        String sqlToUse2 = queryLog.substituteParametersInSqlString(sql, ctx);
+        String sqlToUseResult = queryLog.substituteParametersInSqlString(sql, ctx);
-        assertEquals(sqlToUse, sqlToUse2);
+        assertEquals(sqlToUse, sqlToUseResult);
     }
 }