CRITICAL
Rule Definition
If the Hibernate application is on different systems that are not time-synchronized, the timestamp generated by each system might be different thereby generating improper optimistic lock success or failures.
If your timestamp data type doesn't include a daylight saving time attribute, you'll run into problems with Hibernate's automatic versioning. The version property is less problematic for automatic versioning; hence we recommend it.
Remediation
Use version attribute as a control.
Violation Code Sample
Sample 1
<class name="Sample" table="SAMPLE">
<id ...../>
<timestamp name="lastUpdated" column="LAST_UPDATED"/> // VIOLATION
...
</class>
--------------------------------------
Sample 2
//Timestamping is automatically used if you the @Version annotation on a Date or Calendar
@Entity
public class Flight implements Serializable {
...
@Version //Violation
public Date getLastUpdate() { ... }
}
or
@Entity(name = "Person")
public static class Person {
@Id
private Long id;
private String firstName;
private String lastName;
@Version //Violation
@Source(value = SourceType.DB)
private Date version;
}
--------------------------------------------------------------------------------------------
Fixed Code Sample
Remdiation 1
<class name="Sample" table="SAMPLE">
<id ...../>
<version name="version" column="VERSION"/> // FIXED
...
</class>
------------------------------------------------
Remediation 2
@Entity(name = "Phone")
public static class Phone {
@Id
private Long id;
@Column(name = "`number`")
private String number;
@Version //Fixed
private Long version;
}
Reference
Hibernate in Action (ISBN 1932394-15-X) p 169 and 391
Related Technologies
Technical Criterion
PCI-DSS4-Requirement-6.2.4 - Software engineering techniques or other methods are defined and in use by software development personnel to prevent or mitigate common software attacks and related vulnerabilities
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.