Skip to content

Add safe condition checks - #951

Open
bnvnvnv wants to merge 1 commit into
abel533:masterfrom
bnvnvnv:safe-condition-checks
Open

Add safe condition checks#951
bnvnvnv wants to merge 1 commit into
abel533:masterfrom
bnvnvnv:safe-condition-checks

Conversation

@bnvnvnv

@bnvnvnv bnvnvnv commented Jul 22, 2026

Copy link
Copy Markdown

Summary

Add a safe select option and extend safe condition validation to avoid accidental full-table operations when upstream passes empty parameters.

  • add safeSelect configuration and wire it into object and Example select providers
  • require object-based CRUD safety checks to have at least one effective WHERE condition
  • make Example safety checks reject empty condition values, including null, empty string, empty collection, and empty array
  • cover tk.mybatis Example and generated Example styles in tests

Validation

  • mvn -pl base -am -Dtest=SafeSelectByFieldTest,SafeDeleteByFieldTest,SafeDeleteByMethodTest,SafeUpdateByFieldTest,SafeUpdateByMethodTest -DfailIfNoTests=false -Dsurefire.failIfNoSpecifiedTests=false test
  • mvn -pl base -am -DfailIfNoTests=false test
  • git diff --check

@bnvnvnv
bnvnvnv marked this pull request as ready for review July 22, 2026 10:08
@abel533
abel533 requested a review from Copilot July 27, 2026 05:38

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR introduces a new safeSelect configuration and strengthens “safe” condition validation across object-based and Example-based CRUD operations to prevent accidental full-table reads/updates/deletes when upstream passes empty parameters.

Changes:

  • Add safeSelect to configuration and enforce it in object-based select providers and Example select providers.
  • Strengthen safety checks to require at least one effective condition (including rejecting empty strings/collections/arrays where configured).
  • Extend/adjust tests to cover empty-condition rejection for delete/update/select (including tk.mybatis Example and generated Example styles).

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
core/src/main/java/tk/mybatis/mapper/util/OGNL.java Extends OGNL safety checks to validate “effective” values and reject empty Example criterion values.
core/src/main/java/tk/mybatis/mapper/mapperhelper/SqlHelper.java Wires new OGNL overloads into SQL <bind> helpers with a notEmpty toggle.
core/src/main/java/tk/mybatis/mapper/entity/Config.java Adds safeSelect config flag and property loading support.
base/src/main/java/tk/mybatis/mapper/provider/ExampleProvider.java Enforces safeSelect for selectByExample/selectCountByExample.
base/src/main/java/tk/mybatis/mapper/provider/base/BaseSelectProvider.java Enforces safeSelect for object-based selectOne/select/selectCount.
base/src/main/java/tk/mybatis/mapper/provider/base/BaseUpdateProvider.java Adds PK-parameter safety validation for updateByPrimaryKey* when safeUpdate is enabled.
base/src/main/java/tk/mybatis/mapper/provider/base/BaseDeleteProvider.java Aligns safe-delete object checks with notEmpty behavior.
base/src/test/java/tk/mybatis/mapper/base/select/SafeSelectByFieldTest.java Adds a new test suite validating safe select behavior for object and Example queries.
base/src/test/java/tk/mybatis/mapper/base/update/SafeUpdateByMethodTest.java Adds coverage for null-PK updates and empty-string Example criteria under safe update.
base/src/test/java/tk/mybatis/mapper/base/update/SafeUpdateByFieldTest.java Adds coverage for null-PK updates and empty-string Example criteria under safe update.
base/src/test/java/tk/mybatis/mapper/base/delete/SafeDeleteByMethodTest.java Extends safe delete tests to reject empty-string object fields and Example criteria.
base/src/test/java/tk/mybatis/mapper/base/delete/SafeDeleteByFieldTest.java Extends safe delete tests to reject empty-string object fields and Example criteria.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +119 to +120

@Test
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants