SKumari871977 (Community Member) asked a question.
How to use query with a .jsp file passing the query from Text Area?
I have a scenario, where the sql is being taken from Text area in the jsp file, and some restrictions are made to use only select query.
<td align=left ><TEXTAREA name=“statement” rows="15" cols="100"><%=((statement==null)?"":statement)%></TEXTAREA></td>
<%
if ( statement != null && statement .length() > 0 )
{
// Validation to check if its a select statement or not
PreparedStatement ps = conn.prepareStatement(statement);
ResultSet rs = ps.executeQuery();
}
%>
Any idea or advice, how to mitigate this above scenario?
.png){kind=logo}
Hi @SKumari871977 (Community Member) ,
This functionality is very dangerous and we strongly recommend removing this functionality.
Thank you,
Boy Baukema
Hi @Boy, Security Consultant (Veracode)
This is actually a admin accessible page, and we don't have the permissions to remove the functionality. Any other advice, how to mitigate the scenario?
There are many mitigating controls you can put in place that would reduce the risk, but none that would remove the risk.
I would strongly recommend discussing this with your security team and optionally recommend you to schedule a consultation call with your security team to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema