SDas161249 (Community Member) asked a question.
How to add dynamic columns in sql query ?
//AttributeList is coming from DB
StringBuffer cols = new StringBuffer();
for (Attribute attribute : AttributeList) {
if (cols.length() > 0)
cols.append(", ");
cols.append(attribute.table + "." + attribute.columnName);
}
CWE (https://cwe.mitre.org/data/definitions/89.html)
}
.png){kind=logo}
Hi @SDas161249 (Community Member) ,
Veracode Static Analysis reports a flaw of CWE 89 when it can see any dynamic data from an outside source (like an HTTP request, but also from a database, file, webservice, etc.) go into a query that is then executed.
First we recommend reviewing whether Prepared Statements ( https://docs.oracle.com/javase/tutorial/jdbc/basics/prepared.html ) are appropriate.
Unfortunately, this is not the case for dynamic identifiers.
For dynamic identifiers we generally recommend reviewing if you can hardcode the identifier names. In many applications it's not really necessary to allow all possible identifiers, just a small list (we see this frequently with sorting and ordering).
If however, the functionality of the application is such that you need to support all identifiers we would recommend implementing simple validation with something like the following regex: ^[0-9a-zA-Z_-]{1,255}$, documenting this in a mitigation proposal ( https://help.veracode.com/r/improve_mitigation ) and having this proposal reviewed by a member of your security team.
Thank you,
Boy Baukema