twelve21 (Community Member) asked a question.
EF Core FromSqlInterpolated incorrectly flagged for SQL Injection
Assuming a DbContext with a Persons DbSet, in which each Person has a LastName property, you can execute a SQL query that is not vulnerable to SQL injection using the following code:
var lastName = "some user supplied arbitrary value";
return context.Persons
.FromSqlInterpolated($"SELECT FirstName FROM Person WHERE LastName = {lastName}")
.ToList();
In this case, the parameter supplied to FromSqlInterpolated is a FormattedString, and as such, each interpolated argument gets converted to a parameter in a parameterized query, such as:
SELECT FirstName FROM Person WHERE LastName = @p0
.png){kind=logo}
Hi @twelve21 (Community Member),
Great question! The code snippet you provided looks safe to me. As per the Microsoft documentation, the string interpolation syntax used in FromSqlInterpolated protects against SQL injection attacks (https://docs.microsoft.com/en-us/ef/core/querying/raw-sql). I would like more information about this and would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Thank you,
Florian Walter
We have the same issue.
Is there any work going on Veracode side to resolve it?
Hi @vehsanen (Community Member), I could not find any Support case created for this issue. Please log a case with Veracode Support for this so that it can be investigated by our Support team.
If you have already created a case, you may want to approach your dedicated Veracode program manager to receive some updates on the case.
Thank you,
Florian Walter
Hey @Florian, Security Consultant (Veracode) , I'm surprised to hear it.
I've created a case 00423515 referring to this question.
Hi @vehsanen (Community Member), I'm happy to hear that a case has been created for this now and I quickly checked out the case number you provided. Please always make sure to provide a link to a scan in the Veracode platform which contains the reported issue. This allows our Engineering Team to identify the reason why something may or may not be reported by Veracode Static Analysis in your particular use case, as well as fixing any concrete issues.
Thank you,
Florian Walter