From 6bd6bd4cc0897f8d562e74ccb37c2453aa6b62d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fr=C3=A9d=C3=A9ric=20Delaporte?=
 <12201973+fredericdelaporte@users.noreply.github.com>
Date: Tue, 2 Apr 2024 13:41:29 +0200
Subject: [PATCH] Obsolete literal AddColumn

SqlInsert/UpdateBuilder AddColumn overloads taking a value have a SQL injection vulnerability, and have no usage.
---
 .../SqlCommandTest/SqlInsertBuilderFixture.cs             | 8 +++++++-
 .../SqlCommandTest/SqlUpdateBuilderFixture.cs             | 4 +++-
 src/NHibernate/SqlCommand/SqlInsertBuilder.cs             | 2 ++
 src/NHibernate/SqlCommand/SqlUpdateBuilder.cs             | 2 ++
 4 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/src/NHibernate.Test/SqlCommandTest/SqlInsertBuilderFixture.cs b/src/NHibernate.Test/SqlCommandTest/SqlInsertBuilderFixture.cs
index 795bddf586c..ec1d5c0cb4e 100644
--- a/src/NHibernate.Test/SqlCommandTest/SqlInsertBuilderFixture.cs
+++ b/src/NHibernate.Test/SqlCommandTest/SqlInsertBuilderFixture.cs
@@ -26,7 +26,9 @@ public void InsertSqlStringTest()
 
 			insert.AddColumn("intColumn", NHibernateUtil.Int32);
 			insert.AddColumn("longColumn", NHibernateUtil.Int64);
+#pragma warning disable CS0618 // Type or member is obsolete
 			insert.AddColumn("literalColumn", false, (ILiteralType) NHibernateUtil.Boolean);
+#pragma warning restore CS0618 // Type or member is obsolete
 			insert.AddColumn("stringColumn", 5.ToString());
 
 			SqlCommandInfo sqlCommand = insert.ToSqlCommandInfo();
@@ -53,7 +55,9 @@ public void Commented()
 
 			insert.SetTableName("test_insert_builder");
 
+#pragma warning disable CS0618 // Type or member is obsolete
 			insert.AddColumn("stringColumn", "aSQLValue", (ILiteralType)NHibernateUtil.String);
+#pragma warning restore CS0618 // Type or member is obsolete
 			insert.SetComment("Test insert");
 			string expectedSql =
 	"/* Test insert */ INSERT INTO test_insert_builder (stringColumn) VALUES ('aSQLValue')";
@@ -71,7 +75,9 @@ public void MixingParametersAndValues()
 
 			insert.SetTableName("test_insert_builder");
 
+#pragma warning disable CS0618 // Type or member is obsolete
 			insert.AddColumn("literalColumn", false, (ILiteralType)NHibernateUtil.Boolean);
+#pragma warning restore CS0618 // Type or member is obsolete
 			insert.AddColumn("intColumn", NHibernateUtil.Int32);
 			insert.AddColumn("stringColumn", 5.ToString());
 			insert.AddColumn("longColumn", NHibernateUtil.Int64);
@@ -89,4 +95,4 @@ public void MixingParametersAndValues()
 			Assert.AreEqual(SqlTypeFactory.Int64, actualParameterTypes[1], "Second Parameter Type");			
 		}
 	}
-}
\ No newline at end of file
+}
diff --git a/src/NHibernate.Test/SqlCommandTest/SqlUpdateBuilderFixture.cs b/src/NHibernate.Test/SqlCommandTest/SqlUpdateBuilderFixture.cs
index c0bd0ece22b..96a47f2e245 100644
--- a/src/NHibernate.Test/SqlCommandTest/SqlUpdateBuilderFixture.cs
+++ b/src/NHibernate.Test/SqlCommandTest/SqlUpdateBuilderFixture.cs
@@ -28,7 +28,9 @@ public void UpdateStringSqlTest()
 
 			update.AddColumns(new string[] {"intColumn"}, NHibernateUtil.Int32);
 			update.AddColumns(new string[] {"longColumn"}, NHibernateUtil.Int64);
+#pragma warning disable CS0618 // Type or member is obsolete
 			update.AddColumn("literalColumn", false, (ILiteralType) NHibernateUtil.Boolean);
+#pragma warning restore CS0618 // Type or member is obsolete
 			update.AddColumn("stringColumn", 5.ToString());
 
 			update.SetIdentityColumn(new string[] {"decimalColumn"}, NHibernateUtil.Decimal);
@@ -60,4 +62,4 @@ public void UpdateStringSqlTest()
 			Assert.AreEqual(expectedParameterTypes[3], actualParameterTypes[3], "fourthParam Type");
 		}
 	}
-}
\ No newline at end of file
+}
diff --git a/src/NHibernate/SqlCommand/SqlInsertBuilder.cs b/src/NHibernate/SqlCommand/SqlInsertBuilder.cs
index d73f98fd4d5..07cb35c2483 100644
--- a/src/NHibernate/SqlCommand/SqlInsertBuilder.cs
+++ b/src/NHibernate/SqlCommand/SqlInsertBuilder.cs
@@ -66,6 +66,8 @@ public virtual SqlInsertBuilder AddColumn(string columnName, IType propertyType)
 		/// <param name="val">The value to set for the column.</param>
 		/// <param name="literalType">The NHibernateType to use to convert the value to a sql string.</param>
 		/// <returns>The SqlInsertBuilder.</returns>
+		// Since v5.6
+		[Obsolete("This method is unsafe and has no more usages. Use the overload with a property type and use a parameterized query.")]
 		public SqlInsertBuilder AddColumn(string columnName, object val, ILiteralType literalType)
 		{
 			return AddColumn(columnName, literalType.ObjectToSQLString(val, Dialect));
diff --git a/src/NHibernate/SqlCommand/SqlUpdateBuilder.cs b/src/NHibernate/SqlCommand/SqlUpdateBuilder.cs
index c9b7ccd1352..8ad1d6cb88a 100644
--- a/src/NHibernate/SqlCommand/SqlUpdateBuilder.cs
+++ b/src/NHibernate/SqlCommand/SqlUpdateBuilder.cs
@@ -47,6 +47,8 @@ public SqlUpdateBuilder SetComment(string comment)
 		/// <param name="val">The value to set for the column.</param>
 		/// <param name="literalType">The NHibernateType to use to convert the value to a sql string.</param>
 		/// <returns>The SqlUpdateBuilder.</returns>
+		// Since v5.6
+		[Obsolete("This method is unsafe and has no more usages. Use the overload with a property type and use a parameterized query.")]
 		public SqlUpdateBuilder AddColumn(string columnName, object val, ILiteralType literalType)
 		{
 			return AddColumn(columnName, literalType.ObjectToSQLString(val, Dialect));