This Bugzilla instance is a read-only archive of historic NetBeans bug reports. To report a bug in NetBeans please follow the project's instructions for reporting issues.

Bug 232439 - Incorrect detection of SQL characters inside JSTL sql:query with 4.01 Strict DTD
Summary: Incorrect detection of SQL characters inside JSTL sql:query with 4.01 Strict DTD
Status: RESOLVED WORKSFORME
Alias: None
Product: javaee
Classification: Unclassified
Component: JSP (show other bugs)
Version: 7.4
Hardware: PC Windows 7
: P3 normal (vote)
Assignee: Marek Fukala
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2013-07-09 11:47 UTC by ecerichter
Modified: 2014-07-28 15:37 UTC (History)
2 users (show)

See Also:
Issue Type: DEFECT
Exception Reporter:


Attachments
Screenshot of the issue. (40.53 KB, image/png)
2013-07-09 11:48 UTC, ecerichter
Details
Additional example (40.97 KB, image/png)
2013-07-10 00:03 UTC, ecerichter
Details
This is a example of the problem - this page is a fragment that is included in a more complex page (1.68 KB, application/octet-stream)
2013-07-10 10:10 UTC, ecerichter
Details
screenshot without any errors (177.95 KB, image/png)
2013-07-10 10:20 UTC, Vladimir Riha
Details
Better - more complex - example (3.85 KB, text/plain)
2013-07-10 11:19 UTC, ecerichter
Details
Screenshot of the error in the more complex example (73.04 KB, image/png)
2013-07-10 11:36 UTC, ecerichter
Details

Note You need to log in before you can comment on or make changes to this bug.
Description ecerichter 2013-07-09 11:47:55 UTC
Product Version = NetBeans IDE Dev (Build 201307072319)
Operating System = Windows 7 version 6.1 running on amd64
Java; VM; Vendor = 1.7.0_21
Runtime = Java HotSpot(TM) 64-Bit Server VM 23.21-b01

NetBeans is alerting abou invalid characters inside a sql:query.
Seems that the validator is not considering that it should ignore expressions inside JSTL (actually, HTML parser/validator it should ignore JSTL declarations at all).
Comment 1 ecerichter 2013-07-09 11:48:38 UTC
Created attachment 136868 [details]
Screenshot of the issue.
Comment 2 ecerichter 2013-07-10 00:03:02 UTC
Created attachment 136908 [details]
Additional example
Comment 3 Vladimir Riha 2013-07-10 06:13:34 UTC
Could you please attach also the JSP file? I tried following:


<sql:query var="postWarBabies" dataSource="bar">
        SELECT a.b FROM a
        WHERE cv.status='1' and cv.publicar='Y' AND (a.c <> '' or a.d <> '') 
        AND cv.tipo_vaga in ('1', '2') AND a a.b >= 1
        and test.remove(TI.no_item) like '%' || test.remove(?) like '%'
        group by 1,2
        order by 1,2
        <sql:param value="${firstName}"/>
</sql:query>


And it shows error about sql:param only, which I think is a bug. Thank you in advance.




Product Version: NetBeans IDE Dev (Build 201307100049)
Java: 1.7.0_25; Java HotSpot(TM) Client VM 23.25-b01
Runtime: Java(TM) SE Runtime Environment 1.7.0_25-b15
System: Linux version 3.2.0-48-generic-pae running on i386; UTF-8; en_US (nb)
Comment 4 ecerichter 2013-07-10 10:10:30 UTC
Created attachment 136933 [details]
This is a example of the problem - this page is a fragment that is included in a more complex page
Comment 5 ecerichter 2013-07-10 10:12:06 UTC
This page is used in a <jsp:include ...> from inside a more complex page and/or through jQuery.load() (doesn't matter, depends in using AJAX or not).
Comment 6 Vladimir Riha 2013-07-10 10:20:19 UTC
Created attachment 136934 [details]
screenshot without any errors

Could you please try it in newer build? As you can see on this screenshot, there are no errors (red underline is spellchecker). Thank you


Product Version: NetBeans IDE Dev (Build 201307100049)
Java: 1.7.0_25; Java HotSpot(TM) Client VM 23.25-b01
Runtime: Java(TM) SE Runtime Environment 1.7.0_25-b15
System: Linux version 3.2.0-48-generic-pae running on i386; UTF-8; en_US (nb)
Comment 7 ecerichter 2013-07-10 11:19:01 UTC
Created attachment 136941 [details]
Better - more complex - example
Comment 8 ecerichter 2013-07-10 11:20:39 UTC
(In reply to comment #6)
> Created attachment 136934 [details]
> screenshot without any errors
> 
> Could you please try it in newer build? As you can see on this screenshot,
> there are no errors (red underline is spellchecker). Thank you
> 
> 
> Product Version: NetBeans IDE Dev (Build 201307100049)
> Java: 1.7.0_25; Java HotSpot(TM) Client VM 23.25-b01
> Runtime: Java(TM) SE Runtime Environment 1.7.0_25-b15
> System: Linux version 3.2.0-48-generic-pae running on i386; UTF-8; en_US (nb)

For sure, just updated to DEV201307102300.
Problem still exists with more complex queries.
Comment 9 ecerichter 2013-07-10 11:36:30 UTC
Created attachment 136942 [details]
Screenshot of the error in the more complex example
Comment 10 ecerichter 2013-07-10 11:37:05 UTC
(In reply to comment #9)
> Created attachment 136942 [details]
> Screenshot of the error in the more complex example

This screenshot is from DEV201307102300.
Comment 11 Vladimir Riha 2013-07-10 11:45:35 UTC
Thanks a lot, the screenshot actually helped. The difference is I have HTML5 doctype, while you are using 4.01 Strict and it doesn't like unescaped < >. So it is reproducible with this doctype. Thanks for samples.
Comment 12 David Konecny 2013-08-22 02:21:55 UTC
I do not remember details of "4.01 Strict" validation but this sounds like a user's errror - either encode <> or user different DOCTYPE? Would you agree reporter? Closing as wontfix for now but please feel free to reopen if you disagree. Thx.
Comment 13 ecerichter 2013-08-22 13:43:15 UTC
Hi, thanks for your answer.

The point IMHO doesn't matter which HTML parser I choose, the SQL code inside <sql:query></sql:query> must not be evaluated.

If I encode the SQL code (which is the wrong action, as far as I know), I will get an error at Runtime (syntax error in SQL query).

Regards,

Edson
Comment 14 David Konecny 2013-08-22 22:51:54 UTC
I'm sorry, you are right. HTML Validator should not validate content of <sql:query> tag. A short term workaround would be to switch HTML Validator to less strict version for your JSP files (there is a light bulb on the first line offering that).
Comment 15 Marek Fukala 2014-07-28 15:37:49 UTC
Works fine for me. The html validation is disabled for all templating languages by default. Reporter, can you please confirm? Create a new project/new jsp and put your code into - there should be no html errors until you explicitly enable the checking by the hint fix on the very first line.