Skip to main content

Notice: this Wiki will be going read only early in 2024 and edits will no longer be possible. Please see: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/wikis/Wiki-shutdown-plan for the plan.

Jump to: navigation, search

Difference between revisions of "EclipseLink/FAQ/General"

(How do I get started using EclipseLink?)
(How is EclipseLink Licensed?)
 
(19 intermediate revisions by 4 users not shown)
Line 1: Line 1:
 
== What is EclipseLink? ==
 
== What is EclipseLink? ==
  
Eclipse Persistence Services Project (EclipseLink) is a comprehensive persistence framework delivering a set of persistence services based around leading standards with advanced extensions. Consumers can use EclipseLink within Java EE, SE, and soon OSGi/Equinox environments.  
+
Eclipse Persistence Services Project (EclipseLink) is a comprehensive persistence framework delivering a set of persistence services based around leading standards with advanced extensions. Consumers can use EclipseLink within Java EE, SE, and OSGi/Equinox environments.  
  
The original source contribution for EclipseLink came from [http://www.oracle.com/technology/products/ias/toplink/index.html Oracle Corporation's TopLink product].
+
The original source contribution for EclipseLink came from [http://www.oracle.com/technetwork/middleware/toplink/overview/index.html Oracle Corporation's TopLink product].
  
See [[Introduction to EclipseLink (ELUG)|Introduction to EclipseLink]] in the [[EclipseLink/UserGuide|EclipseLink User's Guide]] for more information.
+
See "Overview of EclipseLink" in ''[http://www.eclipse.org/eclipselink/documentation/ Understanding EclipseLink (Concepts Guide)]'' for more information.
  
 
== How is EclipseLink Licensed? ==
 
== How is EclipseLink Licensed? ==
  
The Eclipse Persistence Services (EclipseLink) project is being developed and distributed* under the [http://www.eclipse.org/legal/epl-v10.html Eclipse Public License] and the [http://www.eclipse.org/org/documents/edl-v10.php Eclipse Distribution Licensed].
+
The EclipseLink project is dual licensed under the [http://www.eclipse.org/legal/epl-v10.html Eclipse Public License] and the [http://www.eclipse.org/org/documents/edl-v10.php Eclipse Distribution Licensed] (BSD).
  
== When is the next release of EclipseLink planned? ==
+
'''EclipseLink Source Header:'''
 
+
<source lang="java">
At present the Eclipse Persistence Services (EclipseLink) project is an [http://www.eclipse.org/projects/dev_process/incubation-phase.php incubating] project at Eclipse. It is producing monthly milestone as well as nightly builds which can be downloaded [http://www.eclipse.org/eclipselink/downloads/index.php here]. For more information on the release schedule please refer to the [http://www.eclipse.org/projects/project_summary.php?projectid=technology.eclipselink project summary] page or the [[EclipseLink/RoadMap | road map]].
+
/**
 +
* ****************************************************************************
 +
* Copyright (c) 2015 Oracle and/or its affiliates. All rights reserved.
 +
* This program and the accompanying materials are made available under the
 +
* terms of the Eclipse Public License v1.0 and Eclipse Distribution License v. 1.0
 +
* which accompanies this distribution.
 +
* The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html
 +
* and the Eclipse Distribution License is available at
 +
* http://www.eclipse.org/org/documents/edl-v10.php.
 +
* *****************************************************
 +
</source>
  
 
== What is the relationship between EclipseLink and the Oracle TopLink product? ==
 
== What is the relationship between EclipseLink and the Oracle TopLink product? ==
  
EclipseLink was initiated based on the contribution of Oracle TopLink ([http://www.oracle.com/technology/tech/eclipse/pdf/eclipselink-faq.pdf Oracle FAQ for TopLink contribution]). the full persistence capabilities Oracle TopLink was contributed.
+
EclipseLink was initiated based on the contribution of Oracle TopLink. The full persistence capabilities Oracle TopLink was contributed.
  
Going forward Oracle TopLink will include EclipseLink to deliver its persistence functionality.
+
Going forward Oracle TopLink will include EclipseLink to deliver its core persistence functionality.
  
 
== What are the components of EclipseLink? ==
 
== What are the components of EclipseLink? ==
Line 30: Line 40:
 
* [[EclipseLink/Components#SDO| SDO]]
 
* [[EclipseLink/Components#SDO| SDO]]
 
* [[EclipseLink/Components#DBWS| DBWS]]
 
* [[EclipseLink/Components#DBWS| DBWS]]
* [[EclipseLink/Components#EIS| EIS]]
+
* [[EclipseLink/Components#Extensions| Extensions]]
 +
* [[EclipseLink/Components#NoSQL| NoSQL]]
 
* [[EclipseLink/Components#Utils| Utils]]
 
* [[EclipseLink/Components#Utils| Utils]]
 
* [[EclipseLink/Components#Examples | Examples]]
 
* [[EclipseLink/Components#Examples | Examples]]
Line 43: Line 54:
  
 
# [http://www.eclipse.org/eclipselink/downloads/ Download EclipseLink]
 
# [http://www.eclipse.org/eclipselink/downloads/ Download EclipseLink]
# [[EclipseLink/UserGuide | Read the EclipseLink User Guide]]
+
# Review the [http://www.eclipse.org/eclipselink/documentation/ EclipseLink Documentation Center]
 
# [[EclipseLink/Examples | Try the EclipseLink Examples and Tutorials]]
 
# [[EclipseLink/Examples | Try the EclipseLink Examples and Tutorials]]
  
Line 50: Line 61:
 
Yes, EclipseLink published a Maven repository so that developers can easily integrate the project's builds/milestones/releases into their Maven build process.  Full instructions can be found on the [[EclipseLink/Maven | EclipseLink/Maven]] page.
 
Yes, EclipseLink published a Maven repository so that developers can easily integrate the project's builds/milestones/releases into their Maven build process.  Full instructions can be found on the [[EclipseLink/Maven | EclipseLink/Maven]] page.
  
== Is SQL generated by EclipseLink vulnerable to SQL injection attacks? ==
 
No, EclipseLink generated SQL is not vulnerable to SQL injection attacks.  SQL injection attacks occur when parameters exposed to an end user are designed in such a way to execute potentially harmful SQL. 
 
 
e.g.
 
"SELECT * FROM users WHERE name = '" + userName + "';"
 
is vulnerable to an injection attack because passing in a user name of "a';DROP TABLE users;SELECT * from users where name = 'a"
 
 
Produces SQL like this:
 
SELECT * FROM users WHERE name = 'a';DROP TABLE users;SELECT * from users where name = 'a';
 
 
The SQL that is generated by EclipseLink prevents these types of attacks in two main ways.
 
* prepared statements.  EclipseLink supports (and defaults to) binding all SQL parameters.  As the SQL is computed before the parameter is passed in, parameterized statements are an effective mechanism for preventing SQL injection (in most resources on preventing injection attacks, prepared statements is the number one recommended solution). 
 
* escaping single quotes.  If the application chooses to have prepared statements turned off, EclipseLink parses parameters for ' and escapes them.  The escaping of the ' means that the resulting SQL will no longer pose a threat to the database (using the above example, the SQL would look something like this:
 
SELECT * FROM users WHERE name = `a``;DROP TABLE users;SELECT * from users where name = ``a`;
 
 
There does exist within EclipseLink a mechanism to allow application developers to query directly using native SQL instead of having EclipseLink generate SQL.  Applications executing raw SQL through EclipseLink must guard against SQL injection as they are bypassing the SQL injection defenses employed by EclipseLink .
 
 
It should go without saying that it is never recommended to expose the native SQL to an application user, doing so would be similar to exposing JDBC API to an application user.  At this point it is no longer an injection attack issue, and more about allowing end users the capability to run any SQL on your Database. 
 
 
[[Category:EclipseLink FAQ|General]]
 
[[Category:EclipseLink FAQ|General]]

Latest revision as of 20:06, 19 March 2015

What is EclipseLink?

Eclipse Persistence Services Project (EclipseLink) is a comprehensive persistence framework delivering a set of persistence services based around leading standards with advanced extensions. Consumers can use EclipseLink within Java EE, SE, and OSGi/Equinox environments.

The original source contribution for EclipseLink came from Oracle Corporation's TopLink product.

See "Overview of EclipseLink" in Understanding EclipseLink (Concepts Guide) for more information.

How is EclipseLink Licensed?

The EclipseLink project is dual licensed under the Eclipse Public License and the Eclipse Distribution Licensed (BSD).

EclipseLink Source Header:

/**
 * ****************************************************************************
 * Copyright (c) 2015 Oracle and/or its affiliates. All rights reserved.
 * This program and the accompanying materials are made available under the
 * terms of the Eclipse Public License v1.0 and Eclipse Distribution License v. 1.0
 * which accompanies this distribution.
 * The Eclipse Public License is available at http://www.eclipse.org/legal/epl-v10.html
 * and the Eclipse Distribution License is available at
 * http://www.eclipse.org/org/documents/edl-v10.php.
 * *****************************************************

What is the relationship between EclipseLink and the Oracle TopLink product?

EclipseLink was initiated based on the contribution of Oracle TopLink. The full persistence capabilities Oracle TopLink was contributed.

Going forward Oracle TopLink will include EclipseLink to deliver its core persistence functionality.

What are the components of EclipseLink?

The EclipseLink project is broken down into several components based on persistence services provided as well an a structure to organize development and produce functional OSGi/Equinox bundles.

Where can I download EclipseLink?

At present EclipseLink can only be downloaded directly from the Eclipse project's website:

http://www.eclipse.org/eclipselink/downloads/index.php

How do I get started using EclipseLink?

  1. Download EclipseLink
  2. Review the EclipseLink Documentation Center
  3. Try the EclipseLink Examples and Tutorials

Can I use EclipseLink with Maven?

Yes, EclipseLink published a Maven repository so that developers can easily integrate the project's builds/milestones/releases into their Maven build process. Full instructions can be found on the EclipseLink/Maven page.

Back to the top