P701965129 (Community Member) asked a question.
How mitigate CWE 89 in DDL, when table names can be different?
Hi, our application creates tables in database for data coming from our internal system (not from user input), simplified example is:
create table [databasename.tablename] ([columnName] [columnType])
PreparedStatement cannot be used for table names, only string concatenation is possible. We don't have predefined table names list. For avoid SQL injection, table names are wrapped with "`", with custom "sanitize" function:
String tableName = sanitize(originalTableName);
String sql = "create table " + tableName + " ...";
conn.createStatement().executeUpdate(sql);
Veracode shows "CWE 89" for such expression after scanning. How mitigate CWE 89 in such case?
.png){kind=logo}
Hi @P701965129 (Community Member) ,
As you stated, parameterization cannot be used for things like table names, column names, etc. In cases where these need to be dynamic, the only way to remediate is using a strict allow-list, which unfortunately would not work for your scenario.
While you can't use allow-lists on a table name basis, you could use an allow-list of acceptable characters depending on the underlying DBMS (in form of a regex). A-Z and underscore, for example.
In any case, you would have to propose a mitigation and discuss it with your security team since the only way Veracode Static Analysis would automatically close this finding would be a strict allow-list for e.g. the table names.
Thank you,
Florian Walter
Hi Florain,
My "sanitize" function protects scripts from injection; the only issue was flaw in Veracode scan even with this function, and how to convince teammates that fix is not possible.
Thanks for answer, yours solution with mitigation will help me with my management.