Tuesday, 15 September 2015

java - Parameters in DynamicJasper AutoText fields? -



java - Parameters in DynamicJasper AutoText fields? -

given study parameter, foo value bar, i'd expect next either print bar if supported parameters, or $p{foo} if supported static text.

autotext showbatchautotext = new autotext("$p{foo}", autotext.position_header, horizontalbandalignment.center);

instead prints ((java.lang.string)parameter_foo.getvalue()), implying kind of logic on field...

is supposed work? misusing "message" type autotext?

dynamicjasper wraps string in quotes before sending jasper. so, sql injection attack style, can bypass escaped quotes.

autotext showbatchautotext = new autotext("\" + $p{foo} + \"", autotext.position_header, horizontalbandalignment.center);

a hack, but... trick.

java dynamic-jasper

No comments:

Post a Comment