Subject: [pgjdbc/pgjdbc] PR #3171: validates resultsetParams in PGStatement constructor. uses assertThro…

From: "vishalvrv9 (@vishalvrv9)" <[email-masked]>
Date: Thu, 21 Mar 2024 15:22:03 +0000

@vlsi @davecramer @sehrope 

This PR adheres to review comments provided in #3167 

- Validation of resultset params is done at the PgStatement constructor as PgPreparedStatement and PgCallableStatement inherit from there and the validation holds true at the base level
- localized messages are provided. Instead of SQL Exception, using PSQLException with invalid param errorcode
- tests now use assertThrows instead of fail

```./gradlew test```, ```./gradlew build```, and  ```./gradlew styleCheck``` are all passing

---

From: "sehrope (@sehrope)" <[email-masked]>
Date: Sat, 23 Mar 2024 13:46:13 +0000

Very nice.

Comparing this branch against the state of the repo just before the prior attempt at this (i.e. pretend the previous commit didn't happen) shows a nice clean diff and makes it easy to see both the change and its correctness:

```diff
$ git diff 24f2c7eea4764cd4e09c2c71bc8c38ee5d4178e5 pgjdbc/src/main/java/
diff --git a/pgjdbc/src/main/java/org/postgresql/jdbc/PgConnection.java b/pgjdbc/src/main/java/org/postgresql/jdbc/PgConnection.java
index 315781d4..ab574c18 100644
--- a/pgjdbc/src/main/java/org/postgresql/jdbc/PgConnection.java
+++ b/pgjdbc/src/main/java/org/postgresql/jdbc/PgConnection.java
@@ -1408,16 +1408,14 @@ public class PgConnection implements BaseConnection {
   public PreparedStatement prepareStatement(String sql, int resultSetType, int resultSetConcurrency,
       int resultSetHoldability) throws SQLException {
     checkClosed();
-    return new PgPreparedStatement(this, sql, resultSetType, resultSetConcurrency,
-        resultSetHoldability);
+    return new PgPreparedStatement(this, sql, resultSetType, resultSetConcurrency, resultSetHoldability);
   }
 
   @Override
   public CallableStatement prepareCall(String sql, int resultSetType, int resultSetConcurrency,
       int resultSetHoldability) throws SQLException {
     checkClosed();
-    return new PgCallableStatement(this, sql, resultSetType, resultSetConcurrency,
-        resultSetHoldability);
+    return new PgCallableStatement(this, sql, resultSetType, resultSetConcurrency, resultSetHoldability);
   }
 
   @Override
diff --git a/pgjdbc/src/main/java/org/postgresql/jdbc/PgStatement.java b/pgjdbc/src/main/java/org/postgresql/jdbc/PgStatement.java
index 944d56eb..98dd512e 100644
--- a/pgjdbc/src/main/java/org/postgresql/jdbc/PgStatement.java
+++ b/pgjdbc/src/main/java/org/postgresql/jdbc/PgStatement.java
@@ -161,11 +161,26 @@ public class PgStatement implements Statement, BaseStatement {
       throws SQLException {
     this.connection = c;
     forceBinaryTransfers |= c.getForceBinary();
+    // validation check for allowed values of resultset type
+    if (rsType != ResultSet.TYPE_FORWARD_ONLY && rsType != ResultSet.TYPE_SCROLL_INSENSITIVE && rsType != ResultSet.TYPE_SCROLL_SENSITIVE) {
+      throw new PSQLException(GT.tr("Unknown value for ResultSet type"),
+          PSQLState.INVALID_PARAMETER_VALUE);
+    }
     resultsettype = rsType;
+    // validation check for allowed values of resultset concurrency
+    if (rsConcurrency != ResultSet.CONCUR_READ_ONLY && rsConcurrency != ResultSet.CONCUR_UPDATABLE) {
+      throw new PSQLException(GT.tr("Unknown value for ResultSet concurrency"),
+          PSQLState.INVALID_PARAMETER_VALUE);
+    }
     concurrency = rsConcurrency;
     setFetchSize(c.getDefaultFetchSize());
     setPrepareThreshold(c.getPrepareThreshold());
     setAdaptiveFetch(c.getAdaptiveFetch());
+    // validation check for allowed values of resultset holdability
+    if (rsHoldability != ResultSet.HOLD_CURSORS_OVER_COMMIT && rsHoldability != ResultSet.CLOSE_CURSORS_AT_COMMIT) {
+      throw new PSQLException(GT.tr("Unknown value for ResultSet holdability"),
+          PSQLState.INVALID_PARAMETER_VALUE);
+    }
     this.rsHoldability = rsHoldability;
   } 
```

---

From: "vlsi (@vlsi)" <[email-masked]>
Date: Fri, 30 May 2025 19:43:39 +0000

(on pgjdbc/src/main/java/org/postgresql/jdbc/PgStatement.java:166)

Error message should better include the problematic value in question. The current error makes it hard to understand the reason for the failure.

---

From: "vishalvrv9 (@vishalvrv9)" <[email-masked]>
Date: Fri, 30 May 2025 20:02:23 +0000

I can take this up.

---

From: "davecramer (@davecramer)" <[email-masked]>
Date: Fri, 30 May 2025 20:04:43 +0000

Please create an issue for it and assign yourself to it. There are other places as well