When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.
More information
.png){kind=logo}
Hi @JBuzek864926 (Community Member),
Since the table name seems to come directly from the HTTP request, I would recommend validating it against a strict allow-list. At this point, it is not only about SQL Injection but also about an attacker potentially being able to insert data into arbitrary tables. Presumably, you have an idea what tables this functionality should be able to access. Please implement an allow-list to make sure that the provided table name conforms to this expectation.
Using an allow-list is something that Veracode Static Analysis can automatically detect and close the finding if applied in a certain way. The following Knowledge Article describes how to do this: https://community.veracode.com/s/article/Using-an-Allow-list-in-a-Way-Static-Analysis-can-Detect
Thanks,
Florian Walter