Safe query objects

Subscribe (Full Service)


	Search: The ACM Digital Library The Guide

	Feedback

Safe query objects: statically typed objects as remotely executable queries

Full text

Pdf (161 KB)

Source

International Conference on Software Engineering archive
Proceedings of the 27th international conference on Software engineering table of contents

St. Louis, MO, USA

SESSION: Databases table of contents

Pages: 97 - 106

Year of Publication: 2005

ISBN:1-59593-963-2

Authors

William R. Cook	University of Texas at Austin
Siddhartha Rai	University of Texas at Austin

Sponsors

ACM: Association for Computing Machinery
SIGSOFT: ACM Special Interest Group on Software Engineering

Publisher

ACM New York, NY, USA

Bibliometrics

Downloads (6 Weeks): 11, Downloads (12 Months): 63, Citation Count: 18

Additional Information:

abstract references cited by index terms collaborative colleagues

Tools and Actions:	Request Permissions Review this Article Save this Article to a Binder Display Formats: BibTeX EndNote ACM Ref

DOI Bookmark:	Use this link to bookmark this Article: http://doi.acm.org/10.1145/1062455.1062488 What is a DOI?

ABSTRACT

Developers of data-intensive applications are increasingly using persistence frameworks such as EJB, Hibernate and JDO to access relational data. These frameworks support both transparent persistence for individual objects and explicit queries to efficiently search large collections of objects. While transparent persistence is statically typed, explicit queries do not support static checking of types or syntax because queries are manipulated as strings and interpreted at runtime. This paper presents Safe Query Objects, a technique for representing queries as statically typed objects while still supporting remote execution by a database server. Safe query objects use object-relational mapping and reflective metaprogramming to translate query classes into traditional database queries. The model supports complex queries with joins, parameters, existentials, and dynamic criteria. A prototype implementation for JDO provides a type-safe interface to the full query functionality in the JDO 1.0 standard.

REFERENCES

Note: OCR errors may be found in this Reference List extracted from the full text article. ACM has opted to expose the complete List rather than only correct and linked references.

	1	S. Alagic and J. Solorzano. Java and OQL: A reflective solution for the impedance mismatch. L'OBJET, 6(2), 2000.
	2	ANSI/INCITS. Database languages - SQLJ - part 1: SQL routines using the Java programming language. Technical Report 331.1-1999, ANSI/INCITS, 1999.
	3	Malcolm P. Atkinson , Ray Welland, Fully Integrated Data Environments: Persistent Programming Languages, Object Stores, and Programmingenvironments, Springer-Verlag New York, Inc., Secaucus, NJ, 1999
	4	Malcolm P. Atkinson , O. Peter Buneman, Types and persistence in database programming languages, ACM Computing Surveys (CSUR), v.19 n.2, p.105-170, June 1987 [doi>10.1145/62070.45066]
	5	Gilad Bracha , Martin Odersky , David Stoutamire , Philip Wadler, Making the future safe for the past: adding genericity to the Java programming language, Proceedings of the 13th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications, p.183-200, October 18-22, 1998, Vancouver, British Columbia, Canada
	6	D. Cengija. Hibernate your data. onJava.com, 2004.
	7	William R. Cook, Interfaces and specifications for the Smalltalk-80 collection classes, conference proceedings on Object-oriented programming systems, languages, and applications, p.1-15, October 18-22, 1992, Vancouver, British Columbia, Canada
	8	Hugh Darwen , C. J. Date, The third manifesto, ACM SIGMOD Record, v.24 n.1, p.39-49, March 1995 [doi>10.1145/202660.202667]
	9	Rowan Davies , Frank Pfenning, A modal analysis of staged computation, Journal of the ACM (JACM), v.48 n.3, p.555-604, May 2001 [doi>10.1145/382780.382785]
	10	R. DeLine and M. Fahndrich. Typestates for objects, 2004.
	11	Carl Gould , Zhendong Su , Premkumar Devanbu, Static Checking of Dynamically Generated Queries in Database Applications, Proceedings of the 26th International Conference on Software Engineering, p.645-654, May 23-28, 2004
	12	G. Hamilton and R. Cattell. JDBC™: A Java SQL API. Sun Microsystems, 1997.
	13	J. Janke. Compiere project overview. compiere.com, 2004.
	14	S. P. Jones. Haskell 98 Language and Libraries. Cambridge University Press, 2003.
	15	Graham Kirby , Ron Morrison , David Stemple, Linguistic reflection in Java, Software—Practice & Experience, v.28 n.10, p.1045-1077, Aug. 1998 [doi>10.1002/(SICI)1097-024X(199808)28:10<1045::AID-SPE191>3.3.CO;2-6]
	16	Daan Leijen , Erik Meijer, Domain specific embedded compilers, Proceedings of the 2nd conference on Domain-specific languages, p.109-122, October 03-06, 1999, Austin, Texas, United States
	17	V. Matena and M. Hapner. Enterprise Java Beans Specification 1.0. Sun Microsystems, 1998.
	18	F. Matthes, A. Rudloff, J. Schmidt, and K. Subieta. A gateway from DBPL to Ingres. In W. Litwin and T. Risch, editors, Applications of Databases, First International Conference, ADB-94, volume 819, pages 365--380. Springer-Verlag, 1994.
	19	E. Meijer and W. Schulte. Programming with rectangles, triangles, and circles. In Proceedings of Conference on XML, 2003.
	20	Shariq Rizvi , Alberto Mendelzon , S. Sudarshan , Prasan Roy, Extending query rewriting techniques for fine-grained access control, Proceedings of the 2004 ACM SIGMOD international conference on Management of data, June 13-18, 2004, Paris, France [doi>10.1145/1007568.1007631]
	21	C. Russell. Java Data Objects (JDO) Specification JSR-12. Sun Microsystems, 2003.
	22	Michiaki Tatsubori , Shigeru Chiba , Kozo Itano , Marc-Olivier Killijian, OpenJava: A Class-Based Macro System for Java, Proceedings of the 1st OOPSLA Workshop on Reflection and Software Engineering: Reflection and Software Engineering, Papers from OORaSE 1999, p.117-133, November 01, 1999
	23	D. Tinker. High performance JDO. JDOGenie.com, 2003.
	24	Murali Venkatrao , Michael Pizzo, SQL/CLI—a new binding style for SQL, ACM SIGMOD Record, v.24 n.4, p.72-77, Dec. 1995 [doi>10.1145/219713.219763]
	25	N. Welsh, F. Solsona, and I. Glover. SchemeUnit and SchemeQL: Two little languages. In Third Workshop on Scheme and Functional Programming, 2002.

CITED BY 18

	Zhendong Su , Gary Wassermann, The essence of command injection attacks in web applications, ACM SIGPLAN Notices, v.41 n.1, p.372-382, January 2006
	William G. J. Halfond , Alessandro Orso, AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks, Proceedings of the 20th IEEE/ACM international Conference on Automated software engineering, November 07-11, 2005, Long Beach, CA, USA
	R. Senthil , D. S. Kushwaha , A. K. Misra, An improved component model for component based software engineering, ACM SIGSOFT Software Engineering Notes, v.32 n.4, July 2007
	Nicolas Juillerat, Enforcing code security in database web applications using libraries and object models, Proceedings of the 2007 Symposium on Library-Centric Software Design, p.31-41, October 21-21, 2007, Montreal, Canada
	Tal Cohen , Joseph (Yossi) Gil , Itay Maman, JTL: the Java tools language, ACM SIGPLAN Notices, v.41 n.10, October 2006
	William G. J. Halfond , Alessandro Orso, Preventing SQL injection attacks using AMNESIA, Proceeding of the 28th international conference on Software engineering, May 20-28, 2006, Shanghai, China
	William G. J. Halfond , Alessandro Orso , Panagiotis Manolios, Using positive tainting and syntax-aware evaluation to counter SQL injection attacks, Proceedings of the 14th ACM SIGSOFT international symposium on Foundations of software engineering, November 05-11, 2006, Portland, Oregon, USA
	Jiang Li, Hierarchical land cover information retrieval in object-oriented remote sensing image databases with native queries, Proceedings of the 45th annual southeast regional conference, March 23-24, 2007, Winston-Salem, North Carolina
	Ben Wiedermann , William R. Cook, Extracting queries by static analysis of transparent persistence, ACM SIGPLAN Notices, v.42 n.1, January 2007
	Joseph (Yossi) Gil , Keren Lenz, Simple and safe SQL queries with c++ templates, Proceedings of the 6th international conference on Generative programming and component engineering, October 01-03, 2007, Salzburg, Austria
	Muhammad Sher , Thomas Magedanz, A vulnerabilities analysis and corresponding middleware security extensions for securing NGN applications, Computer Networks: The International Journal of Computer and Telecommunications Networking, v.51 n.16, p.4697-4709, November, 2007
	Gary Wassermann , Carl Gould , Zhendong Su , Premkumar Devanbu, Static checking of dynamically generated queries in database applications, ACM Transactions on Software Engineering and Methodology (TOSEM), v.16 n.4, p.14-es, September 2007
	Martin Bravenboer , Eelco Dolstra , Eelco Visser, Preventing injection attacks with syntax embeddings, Proceedings of the 6th international conference on Generative programming and component engineering, October 01-03, 2007, Salzburg, Austria
	Sruthi Bandhakavi , Prithvi Bisht , P. Madhusudan , V. N. Venkatakrishnan, CANDID: preventing sql injection attacks using dynamic candidate evaluations, Proceedings of the 14th ACM conference on Computer and communications security, October 28-31, 2007, Alexandria, Virginia, USA
	Zachary Tatlock , Chris Tucker , David Shuffelton , Ranjit Jhala , Sorin Lerner, Deep typechecking and refactoring, ACM SIGPLAN Notices, v.43 n.10, September 2008
	Ben Wiedermann , Ali Ibrahim , William R. Cook, Interprocedural query extraction for transparent persistence, ACM SIGPLAN Notices, v.43 n.10, September 2008
	Anyi Liu , Yi Yuan , Duminda Wijesekera , Angelos Stavrou, SQLProb: a proxy-based architecture towards preventing SQL injection attacks, Proceedings of the 2009 ACM symposium on Applied Computing, March 08-12, 2009, Honolulu, Hawaii
	Adam Kieyzun , Philip J. Guo , Karthick Jayaraman , Michael D. Ernst, Automatic creation of SQL Injection and cross-site scripting attacks, Proceedings of the 2009 IEEE 31st International Conference on Software Engineering, p.199-209, May 16-24, 2009