java 将HSQLDB从2.7.0升级到2.7.1会中断测试

slsn1g29  于 2023-03-16  发布在  Java
关注(0)|答案(1)|浏览(166)

我试图将HSQLDB从2.7.0升级到2.7.1,但是它破坏了测试。测试可以是任何东西,错误总是相同的。
测试类别:

@RunWith( SpringJUnit4ClassRunner.class )
@Transactional( transactionManager = "txManager" )
@Rollback
@ContextConfiguration( "classpath:applicationContext-test.xml" )
public class JdbcOrdersDaoImplTest {

@Autowired
private OrdersAdminDao hsqlOrdersDao;

@Test
public void setUp() {
}

applicationContext-test.xml:

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:jdbc="http://www.springframework.org/schema/jdbc"
       xsi:schemaLocation="http://www.springframework.org/schema/jdbc http://www.springframework.org/schema/jdbc/spring-jdbc-4.3.xsd
        http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-4.3.xsd">

    <import resource="classpath:applicationContext-Order-SQL.xml"/>
    <import resource="classpath:applicationContext-OrderEvent-SQL.xml"/>
    <import resource="classpath:applicationContext-Message-SQL.xml"/>

    <bean id="hsqlDataSource" class="org.apache.commons.dbcp2.BasicDataSource" destroy-method="close">
        <property name="driverClassName" value="org.hsqldb.jdbcDriver"/>
        <property name="url" value="jdbc:hsqldb:mem:test;sql.syntax_pgs=true;hsqldb.sqllog=3;hsqldb.applog=3"/>
        <property name="username" value="Foo"/>
        <property name="password" value=""/>
    </bean>

    <jdbc:initialize-database data-source="hsqlDataSource">
        <jdbc:script location="file:src/main/sql/archive/5.0/init_core_structure.sql"/>
        <jdbc:script location="classpath:hsqldb-create-sequence.sql"/>
        <jdbc:script location="classpath:create-date-function.sql"/>
    </jdbc:initialize-database>

    <bean id="hsqlOrdersDao" class="com.source.fix.gateway.data.impl.JdbcOrdersDaoImpl">
        <property name="dataSource" ref="hsqlDataSource"/>
    </bean>

    <bean id="txManager" class="org.springframework.jdbc.datasource.DataSourceTransactionManager">
        <property name="dataSource" ref="hsqlDataSource"/>
    </bean>

</beans>

堆栈跟踪:

Failed to load ApplicationContext
java.lang.IllegalStateException: Failed to load ApplicationContext
(...)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'org.springframework.jdbc.datasource.init.DataSourceInitializer#0': Invocation of init method failed; nested exception is org.springframework.jdbc.datasource.init.ScriptStatementFailedException: Failed to execute SQL script statement #1 of class path resource [create-date-function.sql]: CREATE FUNCTION DATE(v TIMESTAMP) RETURNS DATE LANGUAGE JAVA DETERMINISTIC NO SQL EXTERNAL NAME 'CLASSPATH:com.source.fix.PostgresDate.date'; nested exception is java.sql.SQLSyntaxErrorException: user lacks privilege or object not found: com.source.fix.PostgresDate
(...)
Caused by: org.springframework.jdbc.datasource.init.ScriptStatementFailedException: Failed to execute SQL script statement #1 of class path resource [create-date-function.sql]: CREATE FUNCTION DATE(v TIMESTAMP) RETURNS DATE LANGUAGE JAVA DETERMINISTIC NO SQL EXTERNAL NAME 'CLASSPATH:com.source.fix.PostgresDate.date'; nested exception is java.sql.SQLSyntaxErrorException: user lacks privilege or object not found: com.source.fix.PostgresDate
(...)
Caused by: java.sql.SQLSyntaxErrorException: user lacks privilege or object not found: com.source.fix.PostgresDate
(...)
Caused by: org.hsqldb.HsqlException: user lacks privilege or object not found: com.source.fix.PostgresDate

以下是2.7.1的更改列表:* 2022年10月20日-版本2.7.1-版本2.7.1 jar需要JRE 11或更高版本-测试至Java 17 -版本2.7.1替代jar需要JRE 8或更高版本- CVE-2022-41853不允许调用java方法-设置hsqldb.方法类名称是访问java方法所必需的-增强RECURSIVE CTE *
以及NIST提供的CVE-2022-41853描述:* 在hsqldb中使用java.sql.语句或java.sql.准备语句的(HyperSQL数据库)可能容易受到远程代码执行攻击。默认情况下,允许调用类路径中任何Java类的任何静态方法,从而导致代码执行。通过更新到2.7.1或设置系统属性“hsqldb.method_class_names”,可以防止此问题允许调用的类。例如,可以使用System.setProperty(“hsqldb.method_class_names”,“abc”)或Java参数-Dhsqldb.method_class_names=“abc”。从版本2.7.1开始,默认情况下,除了java.lang.Math中的类之外,所有类都不可访问,需要手动启用。*
如果我理解正确的话(也许我错了),问题在于应用程序上下文不是自动加载的,我必须手动启用它,但我不知道该怎么做。

8ehkhllq

8ehkhllq1#

运行应用程序的Java命令必须包含外部方法的类名。例如:

java -Dhsqldb.method_class_names="com.source.fix.PostgresDate.date" ...

您应该能够通过将其添加到Spring框架配置中来设置此系统属性。

相关问题