HMurthy089461 (Community Member) asked a question.
CWE-89 Flaw on a simple Query, what am I missing here?
The following Java method is throwing a CWE-89 Veracode SQL validation. Is this because of the use of StringBuilder
StringBuilder sqlQuery = new StringBuilder ("SELECT DISTINCT COLUMN_NAME1 FROM TABLENAME);
PreparedStatement stmt = null;
ResultSet rs = null;
if (conn != null) {
stmt = conn.prepareStatement(sqlQuery.toString());
rs = stmt.executeQuery();
}
while(rs.next()){
String s = rs.getString("COLUMN_NAME1" ); //Veracode Flaw CWE-89 occurs on this line
System.out.println();
}
.png){kind=logo}
Hi @HMurthy089461 (Community Member),
That looks odd to me, reporting SQL Injection on the `rs.getString()` does not much make sense. Could it be by any chance that there was a small change since the latest Veracode scan which lead to a shift in the line numbers? I would recommend a re-scan to check if the issue is then reported on a line that makes more sense.
With respect to your question: There is nothing wrong with using StringBuilder here especially since this is just a static query without any dynamic input, which should not be reported as SQL Injection.
Thank you,
Florian Walter