search

nhibernate / nhibernate-core

NHibernate Object Relational Mapper
https://nhibernate.info
GNU Lesser General Public License v2.1
2.13k stars 925 forks source link

Obsolete vulnerable literal AddColumn #3517

Closed fredericDelaporte closed 4 months ago

fredericDelaporte commented 6 months ago

SqlInsert/UpdateBuilder AddColumn overloads taking a value have a SQL injection vulnerability, and have no usage.

fredericDelaporte commented 4 months ago

If we do that for mitigating some of the issues raised in #3516, it should target the currently released minor instead, I realized. Even if obsoleting members in a patch release is not a normal practice with SemVer, when that is a security issue mitigation, it seems reasonable.

If instead the trouble is fixed at its root in the minor release, then we could keep on targeting the next minor, with another obsolete message.

hazzik commented 4 months ago

Let's do 5.4.x and 5.5.x