Skip to content

Retrieve a set of providers

Loads a clsProviderCollection filtered either by an array of tax IDs or by a caller-supplied raw WHERE clause, both appended to the base provider SELECT by string concatenation rather than bind variables.

Field Value
Operation ID OP-13
Trigger GetProviderCollection(dpi, taxIDs()) / GetProvidersUsingWhere(dpi, whereClause)
Inputs IDataPortalInfo; tax-ID array (String()) or a raw WHERE clause (String)
Outputs clsProviderCollection
Primary components clsProviderCollection.GetProviderCollection, clsProviderCollection.GetProvidersUsingWhere
Entry point SAIF.Business.View.Provider/clsProviderCollection.vb:182, 190

Steps

  1. Criteria.BuildSQLWhere() either emits the caller-supplied WHERE clause verbatim (SQL-PRV-02b) or builds where prv.primary_tax_id in ('…','…') by string concatenation (SQL-PRV-02); the result is appended to clsProvider.Criteria.RETRIEVE_SELECT_SQL against PROVIDER.
  2. BeforeRetrieve adds no parameters for either path.
  3. AfterRetrieve loads one clsProvider per row.
  4. Neither path uses bind variables, so both are exposed to SQL injection if a caller passes untrusted input (BR-PRV-003).

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Caller request]) --> S1{Tax-ID list or WHERE clause?}
    S1 -->|Tax-ID array| S2[BuildSQLWhere: concatenate<br>IN 'tax1','tax2',...]
    S1 -->|Raw WHERE clause| S3["BuildSQLWhere: emit clause<br>verbatim"]
    S2 --> S4["Append to<br>RETRIEVE_SELECT_SQL"]
    S3 --> S4
    S4 --> S5[RetrieveObject via IDataPortalInfo<br>no bind parameters added]
    S5 --> S6["AfterRetrieve: load one<br>clsProvider per row"]
    S6 --> EndOk(["clsProviderCollection<br>returned"])

Failure and edge-case behavior

  • No matching rows: an empty clsProviderCollection is returned.
  • Both retrieval paths concatenate untrusted input directly into SQL text with no bind variables, which is a SQL-injection risk if a caller passes untrusted input (BR-PRV-003).
  • No caller of GetProvidersUsingWhere was found in this repository, so the trust boundary for the WHERE-clause parameter cannot be established here.**

Note: Statements marked with * were inferred from code structure, naming conventions, or contextual evidence where direct confirmation was not available in source artifacts. Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • SAIF.Business.View.Provider/clsProviderCollection.vb