What are the security concerns that I need to look out for with Java Persistence API (JPA)

Question

I'm starting to learn JPA, and I have a considerable amount of legacy EJB2.0 code that will need to be refactored to use the new features, as well as any new functionality that I will add to the code base. Are there new attack vectors that I will need to account for in my code, or will defensive programming cover me?

Answer 1

JPA is like JDBC: a backend technology. The same security concerns that apply to JDBC apply to JPA. So most security consideration will be implemented on the application level or are handled by front end API’s. But indeed JPQL injection is an obvious ones you should be aware of.

JPQL injection:

Just like when using SQL or the JDBC API, you should never directly add your parameters to a query String. You should work with the setParameter on the Query object (applies to both adhoc and named queries) or you could use the JPA criteria API (although named queries offer the best performance).

Query query = em.createQuery("DELETE Order WHERE customer = :customer");
query.setParameter("customer", customer);
query.executeUpdate();

Database rights:

For extra security, you could make multiple persistent units (PU) so the impact of any security breaches is limited. For example you could create multiple PU's with different database access rights: one with update rights and another with read only query access. Just realize that decisions like this will impact your application design.