skumar211968 (Community Member) asked a question.
This database query contains a SQL injection flaw. The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.
String QueryMap = query.toString();
if(StringUtils.isNotEmpty( QueryMap ) && StringUtils.length( QueryMap ) > 1) {
String ruleQuery=(String) query.get( "rulesQuery" );
queryPrepareStatement = con.prepareStatement(ruleQuery);
queryResultSet = queryPrepareStatement.executeQuery();
.png){kind=logo}
Hi skumar211968!
Unfortunately we will need a bit more information to help you. If your able to provide details of the "query" object, what is it? what library is it from?
A traditional usage of SQL prepareStatement would look like the below.
String query = "SELECT account_balance FROM user_data WHERE user_name = ? ";
PreparedStatement pstmt = connection.prepareStatement( query );
pstmt.setString( 1, custname); // This is where the variable is safely inserted into the query
ResultSet results = pstmt.executeQuery( );
In your code snippet, there doesn't appear to be any parameters being added to the prepared statement. If this code is working for you, it must mean the SQL query has been created before being passed through prepareStatement, which means you are getting no protection. Without understanding more about the "query" object, I think it's likely this code is vulnerable to SQLi.
As this is dynamic SQL, it's likely to be too complex for a forum post to understand how we might mitigate this. In the first instance I would read the below OWASP article and see if the code can be refactored to use preparedStatement correctly. I suspect you may need more in-depth guidance for this scenario and would recommend a call with a member of the ASC team. You can schedule a consultation through the Veracode platform.
Resources:
https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
Hope that helps! Seb
How can we use EXECUTE IMMEDIATE statement for dynamic DDL and still pass veracode scan ?
We tried using DBMS_ASSERT package but still the scan is failing..