77 lines
2.0 KiB
Plaintext
77 lines
2.0 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
public User getUser(Connection con, String user) throws SQLException {
|
|
|
|
Statement stmt1 = null;
|
|
Statement stmt2 = null;
|
|
PreparedStatement pstmt;
|
|
try {
|
|
stmt1 = con.createStatement();
|
|
ResultSet rs1 = stmt1.executeQuery("GETDATE()"); // No issue; hardcoded query
|
|
|
|
stmt2 = con.createStatement();
|
|
ResultSet rs2 = stmt2.executeQuery("select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=" + user); // Sensitive
|
|
|
|
pstmt = con.prepareStatement("select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=" + user); // Sensitive
|
|
ResultSet rs3 = pstmt.executeQuery();
|
|
|
|
//...
|
|
}
|
|
|
|
public User getUserHibernate(org.hibernate.Session session, String data) {
|
|
|
|
org.hibernate.Query query = session.createQuery(
|
|
"FROM students where fname = " + data); // Sensitive
|
|
// ...
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
----
|
|
public User getUser(Connection con, String user) throws SQLException {
|
|
|
|
Statement stmt1 = null;
|
|
PreparedStatement pstmt = null;
|
|
String query = "select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=?"
|
|
try {
|
|
stmt1 = con.createStatement();
|
|
ResultSet rs1 = stmt1.executeQuery("GETDATE()");
|
|
|
|
pstmt = con.prepareStatement(query);
|
|
pstmt.setString(1, user); // Good; PreparedStatements escape their inputs.
|
|
ResultSet rs2 = pstmt.executeQuery();
|
|
|
|
//...
|
|
}
|
|
}
|
|
|
|
public User getUserHibernate(org.hibernate.Session session, String data) {
|
|
|
|
org.hibernate.Query query = session.createQuery("FROM students where fname = ?");
|
|
query = query.setParameter(0,data); // Good; Parameter binding escapes all input
|
|
|
|
org.hibernate.Query query2 = session.createQuery("FROM students where fname = " + data); // Sensitive
|
|
// ...
|
|
----
|
|
|
|
include::../see.adoc[]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
endif::env-github,rspecator-view[]
|