pT361987 (Community Member) asked a question.
rs = ps.executeQuery(); // At this line showing flaw
public ArrayList runQueryA(String sql, ArrayList<String> params) {
ResultSet rs = null;
PreparedStatement ps = null;
ArrayList arrs = new ArrayList();
int j = 1;
Connection conn = null;
DataSource ds = null;
try {
Context ctx = new InitialContext();
ds = (DataSource) ctx.lookup("java:comp/env/jdbc/emochila");
conn = ds.getConnection();
ps = conn.prepareStatement(sql);
for (int i = 0; i < params.size(); i++) {
ps.setString(j, params.get(i));
j++;
}
rs = ps.executeQuery();
ResultSetMetaData md = rs.getMetaData();
int columns = md.getColumnCount();
while (rs.next()) {
HashMap row = new HashMap(columns);
for (int i = 1; i <= columns; ++i) {
row.put(md.getColumnLabel(i), rs.getString(i));
}
arrs.add(row);
}
try {
rs.close();
rs = null;
ps.close();
ps = null;
conn.close();
conn = null;
} catch (Exception ex3) {
logger.error(ex3.getMessage(), ex3);
}
} catch (Exception ex) {
logger.error(ex.getMessage(), ex);
} finally {
if (rs != null) {
try {
rs.close();
} catch (SQLException e) {
logger.error(e.getMessage(), e);
}
rs = null;
}
if (ps != null) {
try {
ps.close();
} catch (SQLException e) {
logger.error(e.getMessage(), e);
}
ps = null;
}
if (conn != null) {
try {
conn.close();
} catch (SQLException e) {
logger.error(e.getMessage(), e);
}
conn = null;
}
}
return arrs;
}
.png){kind=logo}
Hi @pT361987 (Community Member) ,
Veracode Static Analysis will report flaws of CWE 89 SQL injection when it can detect that data from outside of the application is going into one of the queries executed by a database execution method.
Use of prepared statements are the first and best defence if it can be used (for more information on defending from SQL injection please see https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html#:~:text=This%20coding%20style%20allows%20the,are%20inserted%20by%20an%20attacker. ).
However, prepared statements will not help if the query passed is still concatenated with user input.
In this case I recommend reviewing all the references of runQueryA and ensuring that all queries passed are not concatenated.
If you have any remaining questions, I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema