Add a discriminator injection test

src/NHibernate.Test/Async/NHSpecificTest/GH3516/FixtureByCode.cs

@@ -8,6 +8,7 @@
 //------------------------------------------------------------------------------
 
 
+using System.Collections;
 using System.Collections.Generic;
 using NHibernate.Cfg.MappingSchema;
 using NHibernate.Mapping.ByCode;
@@ -27,6 +28,17 @@ protected override HbmMapping GetMappings()
 				rc.Id(x => x.Id, m => m.Generator(Generators.GuidComb));
 				rc.Property(x => x.Name);
 			});
+
+			mapper.Class<BaseClass>(rc =>
+			{
+				rc.Id(x => x.Id, m => m.Generator(Generators.GuidComb));
+				rc.Discriminator(x => x.Column("StringDiscriminator"));
+				rc.Property(x => x.Name);
+				rc.Abstract(true);
+			});
+			mapper.Subclass<Subclass1>(rc => rc.DiscriminatorValue(Entity.NameWithSingleQuote));
+			mapper.Subclass<Subclass2>(rc => rc.DiscriminatorValue(Entity.NameWithEscapedSingleQuote));
+
 			return mapper.CompileMappingForAllExplicitlyAddedEntities();
 		}
 
@@ -68,5 +80,25 @@ public void SqlInjectionInStringsAsync(string propertyName)
 			Assert.That(async () => list = await (query.ListAsync<Entity>()), Throws.Nothing);
 			Assert.That(list, Has.Count.EqualTo(1), $"Unable to find entity with name {propertyName}");
 		}
+
+		[Test]
+		public async Task SqlInjectionInStringDiscriminatorAsync()
+		{
+			using var session = OpenSession();
+
+			await (session.SaveAsync(new Subclass1 { Name = "Subclass1" }));
+			await (session.SaveAsync(new Subclass2 { Name = "Subclass2" }));
+
+			// ObjectToSQLString is used for generating the inserts.
+			Assert.That(session.Flush, Throws.Nothing, "Unable to flush the subclasses");
+
+			foreach (var entityName in new[] { nameof(Subclass1), nameof(Subclass2) })
+			{
+				var query = session.CreateQuery($"from {entityName}");
+				IList list = null;
+				Assert.That(async () => list = await (query.ListAsync()), Throws.Nothing, $"Unable to list entities of {entityName}");
+				Assert.That(list, Has.Count.EqualTo(1), $"Unable to find the {entityName} entity");
+			}
+		}
 	}
 }

src/NHibernate.Test/NHSpecificTest/GH3516/FixtureByCode.cs

@@ -1,4 +1,5 @@
-using System.Collections.Generic;
+using System.Collections;
+using System.Collections.Generic;
 using NHibernate.Cfg.MappingSchema;
 using NHibernate.Mapping.ByCode;
 using NUnit.Framework;
@@ -16,6 +17,17 @@ protected override HbmMapping GetMappings()
 				rc.Id(x => x.Id, m => m.Generator(Generators.GuidComb));
 				rc.Property(x => x.Name);
 			});
+
+			mapper.Class<BaseClass>(rc =>
+			{
+				rc.Id(x => x.Id, m => m.Generator(Generators.GuidComb));
+				rc.Discriminator(x => x.Column("StringDiscriminator"));
+				rc.Property(x => x.Name);
+				rc.Abstract(true);
+			});
+			mapper.Subclass<Subclass1>(rc => rc.DiscriminatorValue(Entity.NameWithSingleQuote));
+			mapper.Subclass<Subclass2>(rc => rc.DiscriminatorValue(Entity.NameWithEscapedSingleQuote));
+
 			return mapper.CompileMappingForAllExplicitlyAddedEntities();
 		}
 
@@ -57,5 +69,25 @@ public void SqlInjectionInStrings(string propertyName)
 			Assert.That(() => list = query.List<Entity>(), Throws.Nothing);
 			Assert.That(list, Has.Count.EqualTo(1), $"Unable to find entity with name {propertyName}");
 		}
+
+		[Test]
+		public void SqlInjectionInStringDiscriminator()
+		{
+			using var session = OpenSession();
+
+			session.Save(new Subclass1 { Name = "Subclass1" });
+			session.Save(new Subclass2 { Name = "Subclass2" });
+
+			// ObjectToSQLString is used for generating the inserts.
+			Assert.That(session.Flush, Throws.Nothing, "Unable to flush the subclasses");
+
+			foreach (var entityName in new[] { nameof(Subclass1), nameof(Subclass2) })
+			{
+				var query = session.CreateQuery($"from {entityName}");
+				IList list = null;
+				Assert.That(() => list = query.List(), Throws.Nothing, $"Unable to list entities of {entityName}");
+				Assert.That(list, Has.Count.EqualTo(1), $"Unable to find the {entityName} entity");
+			}
+		}
 	}
 }

src/NHibernate.Test/NHSpecificTest/GH3516/Hierarchy.cs

@@ -0,0 +1,18 @@
+using System;
+
+namespace NHibernate.Test.NHSpecificTest.GH3516
+{
+	public class BaseClass
+	{
+		public virtual Guid Id { get; set; }
+		public virtual string Name { get; set; }
+	}
+
+	public class Subclass1 : BaseClass
+	{
+	}
+
+	public class Subclass2 : BaseClass
+	{
+	}
+}