问使用NamedParameterJdbcTemplate从文件读取参数化查询解决Checkmarx中的SQL注入错误

EN

@Repository
public class ItemRepository {

  @Autowired
  NamedParameterJdbcTemplate jdbcTemplate;

  public List<Item> getData(String action) {
    String sql = IOUtils.toString(getClass().getResourceAsStream("queries/query.sql"));
    MapSqlParameterSource parameters = new MapSqlParameterSource();
    parameters.addValue("action", action, Types.VARCHAR);

    try {
      List<Item> items = jdbcTemplate.query(sql, parameters, new ItemMapper());
      return items;
    } catch (EmptyResultDataAccessException ex) {
      return new ArrayList<>();
    }
  }
}