TPeng155956 (Community Member) asked a question.
Varacode constantly reported SQL Injection: Hibernate (CWE ID 564), even though I have used binding parameters. Very appreciated if anyone can help.
private Query createQueryAndSetParameter(Session em, SqlParameters sqlParameters) {
String hql = sqlParameters.getSql().toString();
Map<String, Object> parameters = sqlParameters.getParameters();
Query query = em.createQuery(hql); // SQL Injection: Hibernate (CWE ID 564) reported on this line
Here is the sql:
public ProductInfo querySingleResult(String productCode) {
StringBuffer sql = new StringBuffer("from ProductInfo p where p.productCode = :productCode");
Map<String, Object> parameters = new HashMap<String, Object>();
parameters.put("productCode", productCode);
.png){kind=logo}
What your encountering is what we call container taint. By placing the SQL command string and the tainted parameters within the same map structure, the scanner perseveres the map object as a taint source. So when you take out the SQL Command and execute the scanner will flag. Recommend you alter your design to keep the SQL command and that of the parameters separated, if you are looking to the platform to properly recognize your solution. Else you'll need to mitigate the issue by design and have your organization sign off of the finding.