🛡️ Sentinel: [HIGH] Fix JPQL injection in DoctorSpecialityController

[ManupaKDU]

🚨 Severity: HIGH
💡 Vulnerability: JPQL Injection vulnerability in DoctorSpecialityController.completeSpeciality. The qry parameter (from user input) was directly concatenated into the JPQL query string, allowing potential injection attacks.
🎯 Impact: An attacker could craft a malicious payload in the autocomplete field to execute arbitrary JPQL queries, potentially leading to unauthorized data access or modification within the database scope.
🔧 Fix:

• Replaced the string concatenation with a parameterized JPQL query (:qry).
• Implemented a HashMap to pass the sanitized input parameter.
• Preserved case-insensitive search by mapping the input to % + qry.toUpperCase() + % and using the JPQL upper(c.name) function (which fixes a subtle logical bug in the original code where the column itself wasn't uppercased).
  ✅ Verification:
• Modified code manually reviewed to ensure proper parameterization.
• Full test suite run (./detect-maven.sh test) and all 246 tests passed successfully.

---

PR created automatically by Jules for task 11744389689903739417 started by @manupawickramasinghe

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.