@GroovyASTTransformation(phase = CompilePhase.CANONICALIZATION) public class GlobalGormQuerySafetyASTTransformation extends java.lang.Object implements ASTTransformation, TransformWithPriority
Global version of GormQuerySafetyTransformer - runs automatically against every class
in every Grails application that has grails-datamapping-core on its compile classpath,
with no developer configuration required.
Since this check is intraprocedural and does not cover every possible way query text can be built (see GormQuerySafetyTransformer's documented limitations), a build that hits a false positive it can't otherwise work around may need to disable it entirely rather than per call site. Setting the {
false skips this transformation for the whole compilation unit - this is a global kill
switch of last resort, not a substitute for GormQuerySafetyTransformer.SUPPRESS_WARNINGS_VALUE.| Modifiers | Name | Description |
|---|---|---|
static java.lang.String |
PROTECT_SQL_INJECTION_ATTACKS_PROPERTY |
System property that enables this check; defaults to true. |
| Type Params | Return Type | Name and description |
|---|---|---|
|
public int |
priority() |
|
public void |
visit(ASTNode[] nodes, SourceUnit source) |
| Methods inherited from class | Name |
|---|---|
class java.lang.Object |
java.lang.Object#equals(java.lang.Object), java.lang.Object#getClass(), java.lang.Object#hashCode(), java.lang.Object#notify(), java.lang.Object#notifyAll(), java.lang.Object#toString(), java.lang.Object#wait(), java.lang.Object#wait(long), java.lang.Object#wait(long, int) |
System property that enables this check; defaults to true. There is no fully
accurate way to guarantee protection against SQL/HQL/Cypher injection at compile time (this
check has documented gaps), so the name describes intent, not a guarantee. Set to
false only as a last resort, e.g. a false positive blocking a build with no other
workaround.