From 72c359b165510e921165f036d6fb8f2a2442b1b2 Mon Sep 17 00:00:00 2001
From: Dan Newton <danknewton@hotmail.com>
Date: Thu, 22 Oct 2020 13:38:39 +0100
Subject: [PATCH] ENT-5886 Parameterised queries in `DBCheckpointStorage`
 (#6768)

Direct SQL was causing issues with the saving of instants not
maintaining their timezones properly.

Changing to parameterised queries fixed this issue.

Also changed other queries to do the same, since it is good practice to
query in this way.
---
 .../persistence/DBCheckpointStorage.kt        | 35 ++++++++++---------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/node/src/main/kotlin/net/corda/node/services/persistence/DBCheckpointStorage.kt b/node/src/main/kotlin/net/corda/node/services/persistence/DBCheckpointStorage.kt
index a3ccbf018c..d9e288bf94 100644
--- a/node/src/main/kotlin/net/corda/node/services/persistence/DBCheckpointStorage.kt
+++ b/node/src/main/kotlin/net/corda/node/services/persistence/DBCheckpointStorage.kt
@@ -435,9 +435,10 @@ class DBCheckpointStorage(
         } else if (checkpoint.status == FlowStatus.FAILED) {
             // We need to update only the 'flowState' to null, and we don't want to update the checkpoint state
             // because we want to retain the last clean checkpoint state, therefore just use a query for that update.
-            val sqlQuery = "Update ${NODE_DATABASE_PREFIX}checkpoint_blobs set flow_state = null where flow_id = '$flowId'"
-            val query = currentDBSession().createNativeQuery(sqlQuery)
-            query.executeUpdate()
+            currentDBSession()
+                .createNativeQuery("Update ${NODE_DATABASE_PREFIX}checkpoint_blobs set flow_state = null where flow_id = :flow_id")
+                .setParameter("flow_id", flowId)
+                .executeUpdate()
             null
         } else {
             checkpointPerformanceRecorder.record(serializedCheckpointState, serializedFlowState)
@@ -491,12 +492,11 @@ class DBCheckpointStorage(
     }
 
     override fun markAllPaused() {
-        val session = currentDBSession()
-        val runnableOrdinals = RUNNABLE_CHECKPOINTS.map { "${it.ordinal}" }.joinToString { it }
-        val sqlQuery = "Update ${NODE_DATABASE_PREFIX}checkpoints set status = ${FlowStatus.PAUSED.ordinal} " +
-                "where status in ($runnableOrdinals)"
-        val query = session.createNativeQuery(sqlQuery)
-        query.executeUpdate()
+        currentDBSession()
+            .createNativeQuery("Update ${NODE_DATABASE_PREFIX}checkpoints set status = :paused_status where status in :runnable_statuses")
+            .setParameter("paused_status", FlowStatus.PAUSED.ordinal)
+            .setParameter("runnable_statuses", RUNNABLE_CHECKPOINTS.map { it.ordinal })
+            .executeUpdate()
     }
 
     @Suppress("MagicNumber")
@@ -627,8 +627,11 @@ class DBCheckpointStorage(
     }
 
     override fun updateCompatible(runId: StateMachineRunId, compatible: Boolean) {
-        val update = "Update ${NODE_DATABASE_PREFIX}checkpoints set compatible = $compatible where flow_id = '${runId.uuid}'"
-        currentDBSession().createNativeQuery(update).executeUpdate()
+        currentDBSession()
+            .createNativeQuery("Update ${NODE_DATABASE_PREFIX}checkpoints set compatible = :compatible where flow_id = :flow_id")
+            .setParameter("compatible", compatible)
+            .setParameter("flow_id", runId.uuid.toString())
+            .executeUpdate()
     }
 
     private fun createDBFlowMetadata(flowId: String, checkpoint: Checkpoint, now: Instant): DBFlowMetadata {
@@ -687,11 +690,11 @@ class DBCheckpointStorage(
     }
 
     private fun setDBFlowMetadataFinishTime(flowId: String, now: Instant) {
-        val session = currentDBSession()
-        val sqlQuery = "Update ${NODE_DATABASE_PREFIX}flow_metadata set finish_time = '$now' " +
-                "where flow_id = '$flowId'"
-        val query = session.createNativeQuery(sqlQuery)
-        query.executeUpdate()
+        currentDBSession()
+            .createNativeQuery("Update ${NODE_DATABASE_PREFIX}flow_metadata set finish_time = :finish_time where flow_id = :flow_id")
+            .setParameter("finish_time", now)
+            .setParameter("flow_id", flowId)
+            .executeUpdate()
     }
 
     private fun InvocationContext.getStartedType(): StartReason {