public class ParameterizedSparqlString extends Object implements PrefixMapping
A Parameterized SPARQL String is a SPARQL query/update into which values may be injected.
Values may be injected in several ways:
Any variable in the command may have a value injected to it, injecting a value replaces all usages of that variable in the command i.e. substitutes the variable for a constant, injection is done by textual substitution.
You can use JDBC style positional parameters if you prefer, a JDBC style
parameter is a single ?
followed by whitespace or certain punctuation
characters (currently ; , .
). Positional parameters have a unique
index which reflects the order in which they appear in the string. Positional
parameters use a zero based index.
StringBuffer
replacement for creating queries since it provides a
large variety of convenience methods for appending things either as-is or as
nodes (which causes appropriate formatting to be applied).
The intended usage of this is where using a QuerySolutionMap
as
initial bindings is either inappropriate or not possible e.g.
This class is useful for preparing both queries and updates hence the generic
name as it provides programmatic ways to replace variables in the query with
constants and to add prefix and base declarations. A Query
or
UpdateRequest
can be created using the asQuery()
and
asUpdate()
methods assuming the command an instance represents is
actually valid as a query/update.
Query
or UpdateRequest
.While this class was in part designed to prevent SPARQL injection it is by no means foolproof because it works purely at the textual level. The current version of the code addresses some possible attack vectors that the developers have identified but we do not claim to be sufficiently devious to have thought of and prevented every possible attack vector.
Therefore we strongly recommend that users concerned about SPARQL Injection attacks perform their own validation on provided parameters and test their use of this class themselves prior to its use in any security conscious deployment. We also recommend that users do not use easily guess-able variable names for their parameters as these can allow a chained injection attack though generally speaking the code should prevent these.
PrefixMapping.Factory, PrefixMapping.IllegalPrefixException, PrefixMapping.JenaLockedException
Extended, Standard
Constructor and Description |
---|
ParameterizedSparqlString()
Creates a new parameterized string with an empty command text
|
ParameterizedSparqlString(PrefixMapping prefixes)
Creates a new parameterized string
|
ParameterizedSparqlString(QuerySolutionMap map)
Creates a new parameterized string
|
ParameterizedSparqlString(QuerySolutionMap map,
PrefixMapping prefixes)
Creates a new parameterized string
|
ParameterizedSparqlString(String command)
Creates a new parameterized string
|
ParameterizedSparqlString(String command,
PrefixMapping prefixes)
Creates a new parameterized string
|
ParameterizedSparqlString(String command,
QuerySolutionMap map)
Creates a new parameterized string
|
ParameterizedSparqlString(String command,
QuerySolutionMap map,
PrefixMapping prefixes)
Creates a new parameterized string
|
ParameterizedSparqlString(String command,
QuerySolutionMap map,
String base)
Creates a new parameterized string
|
ParameterizedSparqlString(String command,
QuerySolutionMap map,
String base,
PrefixMapping prefixes)
Creates a new parameterized string
|
ParameterizedSparqlString(String command,
String base)
Creates a new parameterized string
|
ParameterizedSparqlString(String command,
String base,
PrefixMapping prefixes)
Creates a new parameterized string
|
Modifier and Type | Method and Description |
---|---|
void |
append(boolean b)
Appends a boolean as-is to the existing command text, to ensure correct
formatting when used as a constant consider using the
appendLiteral(boolean) method |
void |
append(char c)
Appends a character to the existing command text
|
void |
append(double d)
Appends a double as-is to the existing command text, to ensure correct
formatting when used as a constant consider using the
appendLiteral(double) method |
void |
append(float f)
Appends a float as-is to the existing command text, to ensure correct
formatting when used as a constant consider using the
appendLiteral(float) method |
void |
append(int i)
Appends an integer as-is to the existing command text, to ensure correct
formatting when used as a constant consider using the
appendLiteral(int) method |
void |
append(long l)
Appends a long as-is to the existing command text, to ensure correct
formatting when used as a constant consider using the
appendLiteral(long) method |
void |
append(Object obj)
Appends an object to the existing command text
|
void |
append(String text)
Appends some text to the existing command text
|
void |
appendIri(org.apache.jena.iri.IRI iri)
Appends an IRI to the command text as a constant using appropriate
formatting
|
void |
appendIri(String uri)
Appends a URI to the command text as a constant using appropriate
formatting
|
void |
appendLiteral(boolean b)
Appends a boolean to the command text as a constant using appropriate
formatting
|
void |
appendLiteral(Calendar dt)
Appends a date time to the command text as a constant using appropriate
formatting
|
void |
appendLiteral(double d)
Appends a double to the command text as a constant using appropriate
formatting
|
void |
appendLiteral(float f)
Appends a float to the command text as a constant using appropriate
formatting
|
void |
appendLiteral(int i)
Appends an integer to the command text as a constant using appropriate
formatting
|
void |
appendLiteral(long l)
Appends a long to the command text as a constant using appropriate
formatting
|
void |
appendLiteral(String value)
Appends a simple literal as a constant using appropriate formatting
|
void |
appendLiteral(String value,
RDFDatatype datatype)
Appends a Typed Literal to the command text as a constant using
appropriate formatting
|
void |
appendLiteral(String value,
String lang)
Appends a literal with a lexical value and language to the command text
as a constant using appropriate formatting
|
void |
appendNode(Node n)
Appends a Node to the command text as a constant using appropriate
formatting
|
void |
appendNode(RDFNode n)
Appends a Node to the command text as a constant using appropriate
formatting
|
Query |
asQuery()
Attempts to take the command text with parameters injected from the
toString() method and parse it as a Query |
UpdateRequest |
asUpdate()
Attempts to take the command text with parameters injected from the
toString() method and parse it as a UpdateRequest |
void |
clearParam(int index)
Clears the value for a positional parameter
|
void |
clearParam(String var)
Clears the value for a variable parameter so the given variable will not
have a value injected
|
void |
clearParams()
Clears all values for both variable and positional parameters
|
ParameterizedSparqlString |
copy()
Makes a full copy of this parameterized string
|
ParameterizedSparqlString |
copy(boolean copyParams)
Makes a copy of the command text, base URI and prefix mapping and
optionally copies parameter values
|
ParameterizedSparqlString |
copy(boolean copyParams,
boolean copyBase,
boolean copyPrefixes)
Makes a copy of the command text and optionally copies other aspects
|
String |
expandPrefix(String prefixed) |
String |
getBaseUri()
Gets the Base URI which will be prepended to a query
|
String |
getCommandText()
Gets the basic Command Text
|
Iterator<Integer> |
getEligiblePositionalParameters()
Gets the eligible positional parameters i.e.
|
Map<String,String> |
getNsPrefixMap() |
String |
getNsPrefixURI(String prefix) |
String |
getNsURIPrefix(String uri) |
Node |
getParam(int index)
Gets the current value for a positional parameter
|
Node |
getParam(String var)
Gets the current value for a variable parameter
|
Map<Integer,Node> |
getPositionalParameters()
Gets the map of currently set positional parameters, this will be an
unmodifiable map
|
Map<String,Node> |
getVariableParameters()
Gets the map of currently set variable parameters, this will be an
unmodifiable map
|
Iterator<String> |
getVars()
Deprecated.
|
PrefixMapping |
lock() |
String |
qnameFor(String uri) |
PrefixMapping |
removeNsPrefix(String prefix) |
boolean |
samePrefixMappingAs(PrefixMapping other) |
void |
setBaseUri(String base)
Sets the Base URI which will be prepended to the query/update
|
void |
setCommandText(String command)
Sets the command text, overwriting any existing command text.
|
void |
setIri(int index,
org.apache.jena.iri.IRI iri)
Sets a positional parameter to an IRI
|
void |
setIri(int index,
String iri)
Sets a positional parameter to an IRI
|
void |
setIri(int index,
URL url)
Sets a positional parameter to an IRI
|
void |
setIri(String var,
org.apache.jena.iri.IRI iri)
Sets a variable parameter to an IRI
|
void |
setIri(String var,
String iri)
Sets a variable parameter to an IRI
|
void |
setIri(String var,
URL url)
Sets a variable parameter to an IRI
|
void |
setLiteral(int index,
boolean value)
Sets a positional parameter to a boolean literal
|
void |
setLiteral(int index,
Calendar dt)
Sets a positional parameter to a date time literal
|
void |
setLiteral(int index,
double d)
Sets a positional parameter to a double literal
|
void |
setLiteral(int index,
float f)
Sets a positional parameter to a float literal
|
void |
setLiteral(int index,
int i)
Sets a positional parameter to an integer literal
|
void |
setLiteral(int index,
Literal lit)
Sets a positional parameter to a Literal
|
void |
setLiteral(int index,
long l)
Sets a positional parameter to an integer literal
|
void |
setLiteral(int index,
String value)
Sets a positional parameter to a literal
|
void |
setLiteral(int index,
String value,
RDFDatatype datatype)
Sets a positional arameter to a typed literal
|
void |
setLiteral(int index,
String value,
String lang)
Sets a positional parameter to a literal with a language
|
void |
setLiteral(String var,
boolean value)
Sets a variable parameter to a boolean literal
|
void |
setLiteral(String var,
Calendar dt)
Sets a variable parameter to a date time literal
|
void |
setLiteral(String var,
double d)
Sets a variable parameter to a double literal
|
void |
setLiteral(String var,
float f)
Sets a variable parameter to a float literal
|
void |
setLiteral(String var,
int i)
Sets a variable parameter to an integer literal
|
void |
setLiteral(String var,
Literal lit)
Sets a variable parameter to a Literal
|
void |
setLiteral(String var,
long l)
Sets a variable parameter to an integer literal
|
void |
setLiteral(String var,
String value)
Sets a variable parameter to a literal
|
void |
setLiteral(String var,
String value,
RDFDatatype datatype)
Sets a variable parameter to a typed literal
|
void |
setLiteral(String var,
String value,
String lang)
Sets a variable parameter to a literal with a language
|
PrefixMapping |
setNsPrefix(String prefix,
String uri) |
PrefixMapping |
setNsPrefixes(Map<String,String> map) |
PrefixMapping |
setNsPrefixes(PrefixMapping other) |
void |
setParam(int index,
Node n)
Sets a Positional Parameter
|
void |
setParam(int index,
RDFNode n)
Sets a positional parameter
|
void |
setParam(String var,
Node n)
Sets a variable parameter
|
void |
setParam(String var,
RDFNode n)
Sets a variable parameter
|
void |
setParams(QuerySolutionMap map)
Sets the Parameters
|
String |
shortForm(String uri) |
String |
toString()
This method is where the actual work happens, the original command text
is always preserved and we just generated a temporary command string by
prepending the defined Base URI and namespace prefixes at the start of
the command and injecting the set parameters into a copy of that base
command string and return the resulting command.
|
PrefixMapping |
withDefaultMappings(PrefixMapping map) |
public ParameterizedSparqlString(String command, QuerySolutionMap map, String base, PrefixMapping prefixes)
command
- Raw Command Textmap
- Initial Parameters to injectbase
- Base URIprefixes
- Prefix Mappingpublic ParameterizedSparqlString(String command, QuerySolutionMap map, String base)
command
- Raw Command Textmap
- Initial Parameters to injectbase
- Base URIpublic ParameterizedSparqlString(String command, QuerySolutionMap map, PrefixMapping prefixes)
command
- Raw Command Textmap
- Initial Parameters to injectprefixes
- Prefix Mappingpublic ParameterizedSparqlString(String command, QuerySolutionMap map)
command
- Raw Command Textmap
- Initial Parameters to injectpublic ParameterizedSparqlString(String command, String base, PrefixMapping prefixes)
command
- Raw Command Textbase
- Base URIprefixes
- Prefix Mappingpublic ParameterizedSparqlString(String command, PrefixMapping prefixes)
command
- Raw Command Textprefixes
- Prefix Mappingpublic ParameterizedSparqlString(String command, String base)
command
- Raw Command Textbase
- Base URIpublic ParameterizedSparqlString(String command)
command
- Raw Command Textpublic ParameterizedSparqlString(QuerySolutionMap map, PrefixMapping prefixes)
map
- Initial Parameters to injectprefixes
- Prefix Mappingpublic ParameterizedSparqlString(QuerySolutionMap map)
map
- Initial Parameters to injectpublic ParameterizedSparqlString(PrefixMapping prefixes)
prefixes
- Prefix Mappingpublic ParameterizedSparqlString()
public void setCommandText(String command)
append(String)
,
appendIri(String)
, appendLiteral(String)
or
appendNode(Node)
methods insteadcommand
- Command Textpublic void append(String text)
text
- Text to appendpublic void append(char c)
c
- Character to appendpublic void append(boolean b)
appendLiteral(boolean)
methodb
- Boolean to appendpublic void append(double d)
appendLiteral(double)
methodd
- Double to appendpublic void append(float f)
appendLiteral(float)
methodf
- Float to appendpublic void append(int i)
appendLiteral(int)
methodi
- Integer to appendpublic void append(long l)
appendLiteral(long)
methodl
- Long to appendpublic void append(Object obj)
obj
- Object to appendpublic void appendNode(Node n)
n
- Node to appendpublic void appendNode(RDFNode n)
n
- Node to appendpublic void appendIri(String uri)
uri
- URI to appendpublic void appendIri(org.apache.jena.iri.IRI iri)
iri
- IRI to appendpublic void appendLiteral(String value)
value
- Lexical Valuepublic void appendLiteral(String value, String lang)
value
- Lexical Valuelang
- Languagepublic void appendLiteral(String value, RDFDatatype datatype)
value
- Lexical Valuedatatype
- Datatypepublic void appendLiteral(boolean b)
b
- Boolean to appendpublic void appendLiteral(int i)
i
- Integer to appendpublic void appendLiteral(long l)
l
- Long to appendpublic void appendLiteral(float f)
f
- Float to appendpublic void appendLiteral(double d)
d
- Double to appendpublic void appendLiteral(Calendar dt)
dt
- Date Time to appendpublic String getCommandText()
Note: This will not reflect any injected parameters, to
see the command with injected parameters invoke the toString()
method
public void setBaseUri(String base)
base
- Base URIpublic String getBaseUri()
public void setParams(QuerySolutionMap map)
map
- Parameterspublic void setParam(int index, Node n)
Setting a parameter to null is equivalent to calling
clearParam(int)
for the given variable
index
- Positional Indexn
- Nodepublic void setParam(String var, Node n)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variablen
- Valuepublic void setParam(int index, RDFNode n)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
index
- Positional Indexn
- Nodepublic void setParam(String var, RDFNode n)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variablen
- Valuepublic void setIri(int index, String iri)
Setting a parameter to null is equivalent to calling
clearParam(int)
for the given index
index
- Positional Indexiri
- IRIpublic void setIri(String var, String iri)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variableiri
- IRIpublic void setIri(int index, org.apache.jena.iri.IRI iri)
Setting a parameter to null is equivalent to calling
clearParam(int)
for the given index
index
- Positional Indexiri
- IRIpublic void setIri(String var, org.apache.jena.iri.IRI iri)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variableiri
- IRIpublic void setIri(int index, URL url)
Setting a parameter to null is equivalent to calling
clearParam(int)
for the given index
index
- Positional Indexurl
- URLpublic void setIri(String var, URL url)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variableurl
- URL used as IRIpublic void setLiteral(int index, Literal lit)
Setting a parameter to null is equivalent to calling
clearParam(int)
for the given index
index
- Positional Indexlit
- Valuepublic void setLiteral(String var, Literal lit)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variablelit
- Valuepublic void setLiteral(int index, String value)
Setting a parameter to null is equivalent to calling
clearParam(int)
for the given index
index
- Positional Indexvalue
- Lexical Valuepublic void setLiteral(String var, String value)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variablevalue
- Lexical Valuepublic void setLiteral(int index, String value, String lang)
Setting a parameter to null is equivalent to calling
clearParam(int)
for the given index
index
- Positional indexvalue
- Lexical Valuelang
- Languagepublic void setLiteral(String var, String value, String lang)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variablevalue
- Lexical Valuelang
- Languagepublic void setLiteral(int index, String value, RDFDatatype datatype)
Setting a parameter to null is equivalent to calling
clearParam(int)
for the given index
index
- Positional Indexvalue
- Lexical Valuedatatype
- Datatypepublic void setLiteral(String var, String value, RDFDatatype datatype)
Setting a parameter to null is equivalent to calling
clearParam(String)
for the given variable
var
- Variablevalue
- Lexical Valuedatatype
- Datatypepublic void setLiteral(int index, boolean value)
index
- Positional Indexvalue
- booleanpublic void setLiteral(String var, boolean value)
var
- Variablevalue
- booleanpublic void setLiteral(int index, int i)
index
- Positional Indexi
- Integer Valuepublic void setLiteral(String var, int i)
var
- Variablei
- Integer Valuepublic void setLiteral(int index, long l)
index
- Positional Indexl
- Integer Valuepublic void setLiteral(String var, long l)
var
- Variablel
- Integer Valuepublic void setLiteral(int index, float f)
index
- Positional Indexf
- Float valuepublic void setLiteral(String var, float f)
var
- Variablef
- Float valuepublic void setLiteral(int index, double d)
index
- Positional Indexd
- Double valuepublic void setLiteral(String var, double d)
var
- Variabled
- Double valuepublic void setLiteral(int index, Calendar dt)
index
- Positional Indexdt
- Date Time valuepublic void setLiteral(String var, Calendar dt)
var
- Variabledt
- Date Time valuepublic Node getParam(String var)
var
- Variablepublic Node getParam(int index)
index
- Positional Index@Deprecated public Iterator<String> getVars()
public Map<String,Node> getVariableParameters()
public Map<Integer,Node> getPositionalParameters()
public Iterator<Integer> getEligiblePositionalParameters()
public void clearParam(String var)
var
- Variablepublic void clearParam(int index)
index
- Positional Indexpublic void clearParams()
public String toString()
This method is where the actual work happens, the original command text is always preserved and we just generated a temporary command string by prepending the defined Base URI and namespace prefixes at the start of the command and injecting the set parameters into a copy of that base command string and return the resulting command.
This class makes no guarantees about the validity of the returned string for use as a SPARQL Query or Update, for example if a variable parameter was injected which was mentioned in the SELECT variables list you'd have a syntax error when you try to parse the query. If you run into issues like this try using a mixture of variable and positional parameters.
toString
in class Object
ARQException
- May be thrown if the code detects a SPARQL Injection
vulnerability because of the interaction of the command
string and the injected variablespublic Query asQuery() throws QueryException
toString()
method and parse it as a Query
QueryException
- Thrown if the command text does not parsepublic UpdateRequest asUpdate()
toString()
method and parse it as a UpdateRequest
public ParameterizedSparqlString copy()
public ParameterizedSparqlString copy(boolean copyParams)
copyParams
- Whether to copy parameterspublic ParameterizedSparqlString copy(boolean copyParams, boolean copyBase, boolean copyPrefixes)
copyParams
- Whether to copy parameterscopyBase
- Whether to copy the Base URIcopyPrefixes
- Whether to copy the prefix mappingspublic PrefixMapping setNsPrefix(String prefix, String uri)
setNsPrefix
in interface PrefixMapping
public PrefixMapping removeNsPrefix(String prefix)
removeNsPrefix
in interface PrefixMapping
public PrefixMapping setNsPrefixes(PrefixMapping other)
setNsPrefixes
in interface PrefixMapping
public PrefixMapping setNsPrefixes(Map<String,String> map)
setNsPrefixes
in interface PrefixMapping
public PrefixMapping withDefaultMappings(PrefixMapping map)
withDefaultMappings
in interface PrefixMapping
public String getNsPrefixURI(String prefix)
getNsPrefixURI
in interface PrefixMapping
public String getNsURIPrefix(String uri)
getNsURIPrefix
in interface PrefixMapping
public Map<String,String> getNsPrefixMap()
getNsPrefixMap
in interface PrefixMapping
public String expandPrefix(String prefixed)
expandPrefix
in interface PrefixMapping
public String shortForm(String uri)
shortForm
in interface PrefixMapping
public String qnameFor(String uri)
qnameFor
in interface PrefixMapping
public PrefixMapping lock()
lock
in interface PrefixMapping
public boolean samePrefixMappingAs(PrefixMapping other)
samePrefixMappingAs
in interface PrefixMapping
Licenced under the Apache License, Version 2.0