16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
100 lines
3.3 KiB
Plaintext
100 lines
3.3 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
public User getUser(Connection con, String user) throws SQLException {
|
|
|
|
Statement stmt1 = null;
|
|
Statement stmt2 = null;
|
|
PreparedStatement pstmt;
|
|
try {
|
|
stmt1 = con.createStatement();
|
|
ResultSet rs1 = stmt1.executeQuery("GETDATE()"); // No issue; hardcoded query
|
|
|
|
stmt2 = con.createStatement();
|
|
ResultSet rs2 = stmt2.executeQuery("select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=" + user); // Sensitive
|
|
|
|
pstmt = con.prepareStatement("select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=" + user); // Sensitive
|
|
ResultSet rs3 = pstmt.executeQuery();
|
|
|
|
//...
|
|
}
|
|
|
|
public User getUserHibernate(org.hibernate.Session session, String data) {
|
|
|
|
org.hibernate.Query query = session.createQuery(
|
|
"FROM students where fname = " + data); // Sensitive
|
|
// ...
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
[source,java]
|
|
----
|
|
public User getUser(Connection con, String user) throws SQLException {
|
|
|
|
Statement stmt1 = null;
|
|
PreparedStatement pstmt = null;
|
|
String query = "select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=?"
|
|
try {
|
|
stmt1 = con.createStatement();
|
|
ResultSet rs1 = stmt1.executeQuery("GETDATE()");
|
|
|
|
pstmt = con.prepareStatement(query);
|
|
pstmt.setString(1, user); // Good; PreparedStatements escape their inputs.
|
|
ResultSet rs2 = pstmt.executeQuery();
|
|
|
|
//...
|
|
}
|
|
}
|
|
|
|
public User getUserHibernate(org.hibernate.Session session, String data) {
|
|
|
|
org.hibernate.Query query = session.createQuery("FROM students where fname = ?");
|
|
query = query.setParameter(0,data); // Good; Parameter binding escapes all input
|
|
|
|
org.hibernate.Query query2 = session.createQuery("FROM students where fname = " + data); // Sensitive
|
|
// ...
|
|
----
|
|
|
|
== See
|
|
|
|
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection
|
|
* https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[OWASP Top 10 2017 Category A1] - Injection
|
|
* https://cwe.mitre.org/data/definitions/89[MITRE, CWE-89] - Improper Neutralization of Special Elements used in an SQL Command
|
|
* https://cwe.mitre.org/data/definitions/564[MITRE, CWE-564] - SQL Injection: Hibernate
|
|
* https://cwe.mitre.org/data/definitions/20[MITRE, CWE-20] - Improper Input Validation
|
|
* https://cwe.mitre.org/data/definitions/943[MITRE, CWE-943] - Improper Neutralization of Special Elements in Data Query Logic
|
|
* https://wiki.sei.cmu.edu/confluence/x/ITdGBQ[CERT, IDS00-J.] - Prevent SQL injection
|
|
* https://www.sans.org/top25-software-errors/#cat1[SANS Top 25] - Insecure Interaction Between Components
|
|
* Derived from FindSecBugs rules https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JPA[Potential SQL/JPQL Injection (JPA)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JDO[Potential SQL/JDOQL Injection (JDO)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_HIBERNATE[Potential SQL/HQL Injection (Hibernate)]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Ensure that string concatenation is required and safe for this SQL query.
|
|
|
|
|
|
include::../highlighting.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
endif::env-github,rspecator-view[]
|