100 lines
3.2 KiB
Plaintext
100 lines
3.2 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
public User getUser(Connection con, String user) throws SQLException {
|
|
|
|
Statement stmt1 = null;
|
|
Statement stmt2 = null;
|
|
PreparedStatement pstmt;
|
|
try {
|
|
stmt1 = con.createStatement();
|
|
ResultSet rs1 = stmt1.executeQuery("GETDATE()"); // No issue; hardcoded query
|
|
|
|
stmt2 = con.createStatement();
|
|
ResultSet rs2 = stmt2.executeQuery("select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=" + user); // Sensitive
|
|
|
|
pstmt = con.prepareStatement("select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=" + user); // Sensitive
|
|
ResultSet rs3 = pstmt.executeQuery();
|
|
|
|
//...
|
|
}
|
|
|
|
public User getUserHibernate(org.hibernate.Session session, String data) {
|
|
|
|
org.hibernate.Query query = session.createQuery(
|
|
"FROM students where fname = " + data); // Sensitive
|
|
// ...
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
[source,java]
|
|
----
|
|
public User getUser(Connection con, String user) throws SQLException {
|
|
|
|
Statement stmt1 = null;
|
|
PreparedStatement pstmt = null;
|
|
String query = "select FNAME, LNAME, SSN " +
|
|
"from USERS where UNAME=?"
|
|
try {
|
|
stmt1 = con.createStatement();
|
|
ResultSet rs1 = stmt1.executeQuery("GETDATE()");
|
|
|
|
pstmt = con.prepareStatement(query);
|
|
pstmt.setString(1, user); // Good; PreparedStatements escape their inputs.
|
|
ResultSet rs2 = pstmt.executeQuery();
|
|
|
|
//...
|
|
}
|
|
}
|
|
|
|
public User getUserHibernate(org.hibernate.Session session, String data) {
|
|
|
|
org.hibernate.Query query = session.createQuery("FROM students where fname = ?");
|
|
query = query.setParameter(0,data); // Good; Parameter binding escapes all input
|
|
|
|
org.hibernate.Query query2 = session.createQuery("FROM students where fname = " + data); // Sensitive
|
|
// ...
|
|
----
|
|
|
|
== See
|
|
|
|
* OWASP - https://owasp.org/Top10/A03_2021-Injection/[Top 10 2021 Category A3 - Injection]
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[Top 10 2017 Category A1 - Injection]
|
|
* CWE - https://cwe.mitre.org/data/definitions/89[CWE-89 - Improper Neutralization of Special Elements used in an SQL Command]
|
|
* CWE - https://cwe.mitre.org/data/definitions/564[CWE-564 - SQL Injection: Hibernate]
|
|
* CWE - https://cwe.mitre.org/data/definitions/20[CWE-20 - Improper Input Validation]
|
|
* CWE - https://cwe.mitre.org/data/definitions/943[CWE-943 - Improper Neutralization of Special Elements in Data Query Logic]
|
|
* https://wiki.sei.cmu.edu/confluence/x/ITdGBQ[CERT, IDS00-J.] - Prevent SQL injection
|
|
* Derived from FindSecBugs rules https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JPA[Potential SQL/JPQL Injection (JPA)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_JDO[Potential SQL/JDOQL Injection (JDO)], https://h3xstream.github.io/find-sec-bugs/bugs.htm#SQL_INJECTION_HIBERNATE[Potential SQL/HQL Injection (Hibernate)]
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Ensure that string concatenation is required and safe for this SQL query.
|
|
|
|
|
|
include::../highlighting.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|