Dollar Sign "$" Causes `IndexOutOfBoundsException` in `PreparedStatement.fillStatementWithParameters`
- Dominant language
- Java
- Stars
- 6.1k
- Forks
- 1.5k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 189
Description
In [PreparedStatement.java](https://github.com/apache/pinot/blob/master/pinot-clients/pinot-java-client/src/main/java/org/apache/pinot/client/PreparedStatement.java), if `value` argument in the `setString` method contains dollar sign "$", it will cause `IndexOutOfBoundsException` when `fillStatementWithParameters` is invoked. For example, if `value` is `"$8.00"`, we will get exceptions like this.
```
java.lang.IndexOutOfBoundsException: No group 8
at java.util.regex.Matcher.start(Matcher.java:375)
at java.util.regex.Matcher.appendReplacement(Matcher.java:880)
at java.util.regex.Matcher.replaceFirst(Matcher.java:1004)
at java.lang.String.replaceFirst(String.java:2178)
at org.apache.pinot.client.PreparedStatement.fillStatementWithParameters(PreparedStatement.java:61)
...
```
This is due to that the dollar sign $ is not properly escaped. To fix this issue, our proposal is to escape dollar sign in the `value`:
```
public void setString(int parameterIndex, String value) {
_parameters[parameterIndex] = "'" + value.replace("'", "''").replace("$", "//$") + "'";
}
```
Contributor guide
Research direction
Start in pinot-clients/pinot-java-client/src/main/java/org/apache/pinot/client/PreparedStatement.java, focusing on setString and fillStatementWithParameters. Reproduce the failure with a value such as "$8.00" and inspect the existing parameter-substitution behavior. Done means dollar-containing string parameters no longer cause IndexOutOfBoundsException.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, database
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 55/100