Avoid PostgreSQL parameter limit for denied resources - #51337
Open
sakshichitnis27 wants to merge 3 commits into
Open
Avoid PostgreSQL parameter limit for denied resources#51337sakshichitnis27 wants to merge 3 commits into
sakshichitnis27 wants to merge 3 commits into
Conversation
Signed-off-by: Sakshi Chitnis <156598682+sakshichitnis27@users.noreply.github.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Prevents PostgreSQL parameter-limit failures in FGAP denied-resource filtering.
Changes:
- Renders denied-resource IDs as Criteria literals.
- Adds regression coverage for 65,536 IDs and quoted identifiers.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
PartialEvaluator.java |
Builds denied-resource predicates using literals. |
PartialEvaluatorTest.java |
Verifies generated SQL avoids excessive bind parameters. |
Comment on lines
+162
to
+163
| CriteriaBuilder.In<String> deniedResources = builder.in(path.get(ID_FIELD)); | ||
| deniedIds.forEach(id -> deniedResources.value(builder.literal(id))); |
Member
|
Please avoid merging the main branch into the PR or rebasing the PR unless there are merge conflicts reported by GitHub or a reviewer asks you for a rebase. This prevents spamming reviewers with notifications and saves minutes on the GitHub actions CI. Also, ensure that the sign-off is added to all commits. Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #51128
Summary
Avoid exceeding PostgreSQL's prepared-statement parameter limit when applying fine-grained admin permission filters to a large number of denied resources.
The partial evaluator previously passed the complete denied-resource ID collection directly to the Criteria API
INpredicate. Hibernate consequently created one bind parameter for every denied ID. When the collection contained more than 65,535 IDs, pgjdbc rejected the prepared statement.Changes
Only the denied-resource predicate is changed. Allowed-resource filtering and unrelated queries remain unchanged.
Testing
Confirmed that the regression test fails before the fix with 65,537 bind parameters.
Confirmed that the fixed denied-resource predicate introduces no bind parameters.
Ran:
./mvnw -pl model/jpa -am testRan:
./mvnw -pl server-spi-private,model/jpa spotless:checkReproduced the original failure against PostgreSQL 16.4 using pgjdbc 42.7.11 with 65,536 parameters.
Confirmed that the literal-based query succeeds against the same PostgreSQL instance.
AI assistance disclosure
An AI agent was used to assist with issue analysis, implementation, and regression-test development. I reviewed the changes, understand their behavior, and independently verified the resulting implementation and test results.