Prem (Community Member) asked a question.
Hi
Veracode reported SQLInjection in code snippet below on query.getResultList(). Code is using Hibernate named parameter binding which is a recommended way as per the OWAP SQL Injection cheat sheet (https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html)
public List<T> findUsingJPAQuery(String queryString, Class<T> type, Map<String, Object> parameters,
NsSearchFilter nsSearchFilter)
{
try{
Query query = entityManager.createQuery(queryString);
if (parameters != null) {
for (String paramName : parameters.keySet()) {
Object value = parameters.get(paramName);
query.setParameter(paramName, value);
}
}
return query.getResultList();
}catch (Exception e) {
throw NsUtil.handleException(e, UNEXPECTED_EXCEPTION, logger);
}
}
Can you please help me to understand why this should not be a false positive ?
Regards
Prem
.png){kind=logo}
Hi @Prem (Community Member)
We see that 'queryString' is passed as an argument to the function, there is no guarantee how that SQL query string was constructed. We will ensure that all references of this function, the SQL string is either hard-coded or constructed using safely trusted variables.
With the above-limited code, it is not possible to determine how the taint is arriving but if the scanner is complaining then there is certainly a possibility of taint being added to the SQL query string.
You can get more information on how the taint is originating from the 'Description' of the flaw from the Triage Page.
We cannot confirm this is a False Positive.
If it is a purely hardcoded string, please maintain a whitelist collection of all the SQL queries which you can cross-check inside this function to be sure and guarantee that it is a safe hard-coded SQL query.
If after reviewing the details in the Triage Flaws view in the Veracode Platform you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif