@ edu . umd . cs . findbugs . annotations . SuppressWarnings ( "SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING" ) private UserRecord getUserRecord ( final String domain , final String userName ) throws LoginException { String userId ; String credential ; Connection connection = null ; PreparedStatement statement = null ; ResultSet resultSet = null ; try { connection = getDatabaseConnection ( ) ; statement = connection . prepareStatement ( dbProps . get ( ) . getSqlUserQuery ( ) ) ; statement . setString ( 1 , domain ) ; statement . setString ( 2 , userName ) ; resultSet = statement . executeQuery ( ) ; if ( resultSet . next ( ) ) { userId = resultSet . getString ( 1 ) ; credential = resultSet . getString ( 2 ) ; } else { final String error = "Username '" + userName + "' does not exist (query returned zero results)" ; LOG . warn ( error ) ; throw new LoginException ( error ) ; } resultSet . close ( ) ; statement . close ( ) ; } catch ( SQLException e ) { final String error = "Error executing SQL query" ; LOG . warn ( error , e ) ; throw Util . newLoginException ( error , e ) ; } finally { DbUtil . close ( resultSet ) ; DbUtil . close ( statement ) ; DbUtil . close ( connection ) ; } return new UserRecord ( domain , userName , userId , credential ) ; }
The SQL statement is retrieved from the configuration and the admin is trusted