SDas161249 (Community Member) asked a question.
Dynamic sequence generator name
We have one method which generates nextVal for a particular sequencegenerator. i.e:
function next(String sequenceName, Connection conn){
sql = "Select " + sequenceName + ".nextval from dual";
...
}
sequenceName is created by concatenating a constant with an integer value.
Its showing as Improper Neutralization of Special Elements used in an SQL Command.
Need a help in mitigating this.
.png){kind=logo}
Hi @SDas161249 (Community Member) ,
Veracode Static Analysis does not consider constants and integers sources of attacker controlled input. We may be reporting a different query or reporting this for a different reason, without more detail it is difficult to say.
I would recommend you schedule a consultation call to discuss this in detail.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema