From 9170a8bd355f3404566463a8d130fa333381cf98 Mon Sep 17 00:00:00 2001
From: Filip Hrisafov <filip.hrisafov@gmail.com>
Date: Tue, 29 Oct 2024 09:27:04 +0100
Subject: [PATCH] Use safe ids when querying process and case definitions by
 ids

---
 .../impl/repository/CaseDefinitionQueryImpl.java     |  4 ++++
 .../cmmn/db/mapping/entity/CaseDefinition.xml        | 12 ++++++++----
 .../engine/impl/ProcessDefinitionQueryImpl.java      |  4 ++++
 .../flowable/db/mapping/entity/ProcessDefinition.xml | 12 ++++++++----
 4 files changed, 24 insertions(+), 8 deletions(-)

diff --git a/modules/flowable-cmmn-engine/src/main/java/org/flowable/cmmn/engine/impl/repository/CaseDefinitionQueryImpl.java b/modules/flowable-cmmn-engine/src/main/java/org/flowable/cmmn/engine/impl/repository/CaseDefinitionQueryImpl.java
index 7fa76bf4293..cea2f97be79 100644
--- a/modules/flowable-cmmn-engine/src/main/java/org/flowable/cmmn/engine/impl/repository/CaseDefinitionQueryImpl.java
+++ b/modules/flowable-cmmn-engine/src/main/java/org/flowable/cmmn/engine/impl/repository/CaseDefinitionQueryImpl.java
@@ -403,6 +403,10 @@ public Set<String> getIds() {
         return ids;
     }
 
+    public List<List<String>> getSafeIds() {
+        return getSafeList(ids);
+    }
+
     public String getName() {
         return name;
     }
diff --git a/modules/flowable-cmmn-engine/src/main/resources/org/flowable/cmmn/db/mapping/entity/CaseDefinition.xml b/modules/flowable-cmmn-engine/src/main/resources/org/flowable/cmmn/db/mapping/entity/CaseDefinition.xml
index 63dfd1761cf..1fe7896b091 100644
--- a/modules/flowable-cmmn-engine/src/main/resources/org/flowable/cmmn/db/mapping/entity/CaseDefinition.xml
+++ b/modules/flowable-cmmn-engine/src/main/resources/org/flowable/cmmn/db/mapping/entity/CaseDefinition.xml
@@ -184,10 +184,14 @@
         RES.ID_ = #{id, jdbcType=VARCHAR}
       </if>
       <if test="ids != null and ids">
-        and RES.ID_ in
-        <foreach item="id" index="index" collection="ids" open="(" separator="," close=")">
-          #{id, jdbcType=VARCHAR}
-        </foreach>
+          and (
+              <foreach item="listItem" collection="safeIds" separator="OR">
+                  RES.ID_ in
+                  <foreach item="id" collection="listItem" open="(" separator="," close=")">
+                      #{id, jdbcType=VARCHAR}
+                  </foreach>
+              </foreach>
+          )
       </if>
       <if test="category != null">
         and RES.CATEGORY_ = #{category, jdbcType=VARCHAR}
diff --git a/modules/flowable-engine/src/main/java/org/flowable/engine/impl/ProcessDefinitionQueryImpl.java b/modules/flowable-engine/src/main/java/org/flowable/engine/impl/ProcessDefinitionQueryImpl.java
index 64523d70668..0e658241eb7 100644
--- a/modules/flowable-engine/src/main/java/org/flowable/engine/impl/ProcessDefinitionQueryImpl.java
+++ b/modules/flowable-engine/src/main/java/org/flowable/engine/impl/ProcessDefinitionQueryImpl.java
@@ -455,6 +455,10 @@ public Set<String> getIds() {
         return ids;
     }
 
+    public List<List<String>> getSafeIds() {
+        return getSafeList(ids);
+    }
+
     public String getName() {
         return name;
     }
diff --git a/modules/flowable-engine/src/main/resources/org/flowable/db/mapping/entity/ProcessDefinition.xml b/modules/flowable-engine/src/main/resources/org/flowable/db/mapping/entity/ProcessDefinition.xml
index 2d1867bf1bf..33eda936fa0 100644
--- a/modules/flowable-engine/src/main/resources/org/flowable/db/mapping/entity/ProcessDefinition.xml
+++ b/modules/flowable-engine/src/main/resources/org/flowable/db/mapping/entity/ProcessDefinition.xml
@@ -167,10 +167,14 @@
         RES.ID_ = #{id, jdbcType=NVARCHAR}
       </if>
       <if test="ids != null and ids">
-        and RES.ID_ in
-        <foreach item="id" index="index" collection="ids" open="(" separator="," close=")">
-          #{id, jdbcType=NVARCHAR}
-        </foreach>
+          and (
+              <foreach item="listItem" collection="safeIds" separator="OR">
+                  RES.ID_ in
+                  <foreach item="id" collection="listItem" open="(" separator="," close=")">
+                      #{id, jdbcType=NVARCHAR}
+                  </foreach>
+              </foreach>
+          )
       </if>
       <if test="category != null">
         and RES.CATEGORY_ = #{category, jdbcType=NVARCHAR}