Skip to content

Commit

Permalink
Update h2 database to 2.0.202 to avoid XXE CVE
Browse files Browse the repository at this point in the history
https://security.snyk.io/vuln/SNYK-JAVA-COMH2DATABASE-1769238

NOTE: This CVE did not impact this project directly as we were not using the XML abilities of JDBC.

Also had to update SQL to be compliant with new h2 version.
  • Loading branch information
danfickle committed Dec 10, 2021
1 parent 43e2723 commit ef4dcae
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 3 deletions.
2 changes: 1 addition & 1 deletion pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,7 @@
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<version>1.4.200</version>
<version>2.0.202</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -186,7 +186,7 @@ private static Object uploadResumeJson(Request req, Response res) {
String token = getHex(tokenBytes);

// Insert into db.
String sql = "INSERT INTO resumes(id, json, token, ts, template) VALUES(NULL, ?, ?, NOW(), ?)";
String sql = "INSERT INTO resumes(id, json, token, ts, template) VALUES(DEFAULT, ?, ?, NOW(), ?)";
PreparedStatement stmt = conn.prepareStatement(sql, Statement.RETURN_GENERATED_KEYS);
stmt.setString(1, json);
stmt.setString(2, token);
Expand Down Expand Up @@ -300,7 +300,7 @@ public static void main(String[] args) throws ClassNotFoundException {
try(Connection conn = getDb()) {
String sql =
"CREATE TABLE IF NOT EXISTS resumes ( " +
"id BIGINT IDENTITY PRIMARY KEY, json VARCHAR(10000), token VARCHAR(50), ts TIMESTAMP, template VARCHAR(64) )";
"id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY, json VARCHAR(10000), token VARCHAR(50), ts TIMESTAMP, template VARCHAR(64) )";

conn.createStatement().executeUpdate(sql);
} catch (SQLException sqlEx) {
Expand Down

0 comments on commit ef4dcae

Please sign in to comment.