Security News
Supply Chain Attack Detected in Solana's web3.js Library
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
com.montrosesoftware:DbAssist-jpa-commons
Advanced tools
The artifact provides a query builder, which implements a partial fix for the incorrect time zone shift when writing to/reading from a DB
The DbAssist fixes for different versions of Hibernate are contained in the directories named in the following manner:
DbAssist-[Core Hibernate O/RM version]
If the Hibernate version is preceded by -hbm
prefix, it supports only Hibernate setup with HBM files (the case occurs for older Hibernate versions). If there is no -hbm
prefix, the DbAssist fix version supports both JPA Annotations (with/without Spring Boot) and HBM files. For more information, refer to this section.
DbAssist provides the fix for the unexpected date time shift. This issue does not occur at all on condition that all the components which are used in the project (servers, clients etc.) are set up in the same time zone. If at least one component has a different time zone (for example, we want to store dates in a database as UTC0, but leave the application servers in local time zone), then the unexpected time shift is experienced whenever read/write operation are performed.
The project also introduces ConditionsBuilder
class which enables the user to easily create complex logical combinations of conditions in the SQL query.
For more information about the issue and the detailed explanation of the problem you can refer to the following sources:
In order to fix the issue with date shift, you need to determine first if you want to use JPA annotations or .hbm files to map your entities. Depending on your choice, add the following dependency to your project's pom file and pick the correct version from the table in Compatibility section.
<dependency>
<groupId>com.montrosesoftware</groupId>
<artifactId>DbAssist-5.2.2</artifactId>
<version>1.0-RELEASE</version>
</dependency>
The fix is slightly different for both entity mapping methods:
You do not modify the java.util.Date
type of dates fields in your entity class. However, you need to change the way how they are mapped in the .hbm
file of your entities. You can do it by using our custom type, UtcDateType
:
ExampleEntity.hbm.xml
<property name="createdAtUtc" type="com.montrosesoftware.dbassist.types.UtcDateType" column="created_at_utc"/>
ExampleEntity.java
(not modified)
public class ExampleEntity {
private int id;
private String name;
private Date createdAtUtc;
//setters and getters
}
In case of JPA Annotations set up with Spring Boot, just add the @EnableAutoConfiguration
annotation before the application class. If using plain Hibernate with preferences.xml
, we need to add a single line of code in the configuration file.
The exception is when we are using Hibernate's Specification
class to specify WHERE
conditions. In order to fix it we have two options, which are described in details on the wiki page
Please find below the most recent versions of the artifacts of the DbAssist project:
Artifact name | Recent version |
---|---|
DbAssist-hbm-3.3.2 | |
DbAssist-hbm-3.6.10 | |
DbAssist-4.2.21 | |
DbAssist-4.3.11 | |
DbAssist-5.0.10 | |
DbAssist-5.1.1 | |
DbAssist-5.2.2 | |
DbAssist-jpa-commons |
The list of supported Hibernate versions and their fix counterparts is in the table below:
Hibernate version | HBM | JPA |
---|---|---|
3.3.2.GA | DbAssist-hbm-3.3.2 | N/A |
3.6.10.Final | DbAssist-hbm-3.6.10 | N/A |
4.2.21.Final | DbAssist-4.2.21 | DbAssist-4.2.21 |
4.3.11.Final | DbAssist-4.3.11 | DbAssist-4.3.11 |
5.0.10.Final | DbAssist-5.0.10 | DbAssist-5.0.10 |
5.1.1.Final | DbAssist-5.1.1 | DbAssist-5.1.1 |
5.2.2.Final | DbAssist-5.2.2 | DbAssist-5.2.2 |
4.0
4.1
4.2
DbAssist-jpa-commons
libraryConditionsBuilder cb = new ConditionsBuilder();
//prepare conditions
Condition c1 = cb.lessThan("id", 15);
Condition c2 = cb.equal("name", "Mont");
...
Condition c5 = ...
//construct logical expression
Condition hc =
or(
and(c1, c2),
or(c3, and(c4, c5))
);
//apply the conditions hierarchy to the conditions builder
cb.apply(hc);
List<User> users = uRepo.find(cb);
Result:
WHERE (c1 AND c2) OR c3 OR (c4 AND c5)
More examples and the tutorial for DbAssist library is available on the wiki page
git checkout -b my-new-feature
git commit -am 'Add some feature'
git push origin my-new-feature
The MIT License (MIT) Copyright (c) 2016 Montrose Software
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
The artifact provides a query builder, which implements a partial fix for the incorrect time zone shift when writing to/reading from a DB
We found that com.montrosesoftware:DbAssist-jpa-commons demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A supply chain attack has been detected in versions 1.95.6 and 1.95.7 of the popular @solana/web3.js library.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.