Viewing Contrib/3541
Full headers

Major security issue: yes  no

Notes:
jdbc-ldap
Notification:

Date: Tue, 15 Feb 2005 19:07:39 GMT
From: robinsoncharles@comcast.net
To: openldap-its@OpenLDAP.org
Subject: ResultSet getString(int i)

Full_Name: Charles Robinson
Version: doc says 0.1 zip suggests 2.0
OS: Wiin 2000
URL: ftp://ftp.openldap.org/incoming/
Submission from: (NULL) (130.36.62.127)


When analyzing the ResultSet derived from a Select as follows (notice the
explicit names in the select)

ResultSet rs = stmt.executeQuery("SELECT
cn,displayName,givenName,department,mail FROM ou=Users where
sn="+lastnames[i]);

I found that if I did a rs.getString(1) I got a random column.
I converted to rs.getString("cn") and got the column named.

It looked as if the result set was ordered by whatever order LDAP itself turned
back, not what the programmer specified in the select.


 

Followup 1

Date: Sat, 19 Feb 2005 11:31:26 +0100
From: Pierangelo Masarati <ando@sys-net.it>
To: robinsoncharles@comcast.net
CC: openldap-its@OpenLDAP.org
Subject: Re: (ITS#3541) ResultSet getString(int i)

robinsoncharles@comcast.net wrote:

>Full_Name: Charles Robinson
>Version: doc says 0.1 zip suggests 2.0
>OS: Wiin 2000
>URL: ftp://ftp.openldap.org/incoming/
>Submission from: (NULL) (130.36.62.127)
>
>
>When analyzing the ResultSet derived from a Select as follows (notice the
>explicit names in the select)
>
>ResultSet rs = stmt.executeQuery("SELECT
>cn,displayName,givenName,department,mail FROM ou=Users where
>sn="+lastnames[i]);
>
>I found that if I did a rs.getString(1) I got a random column.
>I converted to rs.getString("cn") and got the column named.
>
>It looked as if the result set was ordered by whatever order LDAP itself
turned
>back, not what the programmer specified in the select.
>  
>
It is unclear what client software is being used; it seems o be unrelated to
OpenLDAP software.  In any case, OpenLDAP's slapd returns the attributes in an
implementation dependent order that may be totally unrelated to the order they
are requested; there is no indication in the specs as per what order attributes
must be returned.

p.






    SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax: +390382476497

Followup 2

From: "Charles Robinson" <robinsoncharles@comcast.net>
To: "'Pierangelo Masarati'" <ando@sys-net.it>
Cc: <openldap-its@openldap.org>
Subject: RE: (ITS#3541) ResultSet getString(int i)
Date: Sat, 19 Feb 2005 11:13:53 -0600

Your answer certainly agrees with my observations.

However, I was under the impression that the SQL standard did specify
the order of return when the programmer specified explicit columns in
the select statement (did not use something like the * notation).

As least this is the way I have seen every SQL vendor I ever dealt with
before (Oracle, Informix, Sybase). Anc certainly the order of results
did not change between rows of the result set :-(

IMHO, this is probably not an openLDAP slapd issue, rather it is a
surprising feature of the JDBC-LDAP Bridge Driver (JDBC-LDAP) by
OctetString




I've stopped 3,102 spam messages. You can too!
One month FREE spam protection at http://www.cloudmark.com/spamnetsig/}
-----Original Message-----
From: Pierangelo Masarati [mailto:ando@sys-net.it] 
Sent: Saturday, February 19, 2005 4:31 AM
To: robinsoncharles@comcast.net
Cc: openldap-its@OpenLDAP.org
Subject: Re: (ITS#3541) ResultSet getString(int i)

robinsoncharles@comcast.net wrote:

>Full_Name: Charles Robinson
>Version: doc says 0.1 zip suggests 2.0
>OS: Wiin 2000
>URL: ftp://ftp.openldap.org/incoming/
>Submission from: (NULL) (130.36.62.127)
>
>
>When analyzing the ResultSet derived from a Select as follows (notice
the
>explicit names in the select)
>
>ResultSet rs = stmt.executeQuery("SELECT
>cn,displayName,givenName,department,mail FROM ou=Users where
>sn="+lastnames[i]);
>
>I found that if I did a rs.getString(1) I got a random column.
>I converted to rs.getString("cn") and got the column named.
>
>It looked as if the result set was ordered by whatever order LDAP
itself turned
>back, not what the programmer specified in the select.
>  
>
It is unclear what client software is being used; it seems o be
unrelated to OpenLDAP software.  In any case, OpenLDAP's slapd returns
the attributes in an implementation dependent order that may be totally
unrelated to the order they are requested; there is no indication in the
specs as per what order attributes must be returned.

p.






    SysNet - via Dossi,8 27100 Pavia Tel: +390382573859 Fax:
+390382476497

Followup 3

Date: Tue, 14 Jun 2005 20:54:14 -0400
From: Marc Boorshtein <mboorshtein@gmail.com>
To: openldap-its@OpenLDAP.org
Subject: Re: (ITS#3541) ResultSet getString(int i)
Cc: robinsoncharles@comcast.net

This SHOULD allow you to get attrbutes via number the way you request
them as this is part of the JDBC spec.  I'll make this a feature
request.

Marc