Hello @RGandikota Venkata649492 (Community Member)​ ,

When using Content Resolver, to prevent possible SQL Injections, you can implement the query with positional or replaceable parameters. In this way, the tainted user input can be defined in the selectionArgs and set safely.

Example:

// Defines selection criteria for the rows you want to delete

String mSelectionClause = UserDictionary.Words.APP_ID + " LIKE ?";

// Defines an array to contain the selection arguments

String[] selectionArgs = {""};

// Sets the selection argument to the user's input

selectionArgs[0] = UserInput;

..

..

// Deletes the words that match the selection criteria

mRowsDeleted = getContentResolver().delete(

    UserDictionary.Words.CONTENT_URI,   // the user dictionary content URI

    mSelectionClause                    // the column to select on

    selectionArgs                      // the value to compare to

);

Reference: https://developer.android.com/reference/android/content/ContentResolver

"selectionArgs : You may include ?s in selection, which will be replaced by the values from selectionArgs, in the order that they appear in the selection. The values will be bound as Strings. This value may be null."

Thank you for the reply.

I tried the way you posted. But, still seeing the same flaws.

I am 3 issues where

Veracode is showing flaw at

1. contentResolver.insert(uri, contentValues)', that second argument is having tainted data. The tainted data originated from an earlier call to android.app.Activity.getIntent
2. contentResolver.update(uri, contentValues, null, null), that the second argument is having tainted data. The tainted data originated from an earlier call to android.app.Activity.getIntent.
3. contentResolver.delete(uri, null, null), that first argument contains tainted data from the variable uri. The tainted data originated from an earlier call to android.app.Activity.getIntent.

Regarding the first two flaws,

I am using the contentValues this way(Kotlin)

val contentValues = ContentValues().apply {

put(MediaStore.DownloadColumns.TITLE, name)

put(MediaStore.DownloadColumns.DISPLAY_NAME, name)

put(MediaStore.DownloadColumns.DATE_MODIFIED, modifiedDate)

put(MediaStore.DownloadColumns.MIME_TYPE, mimeType)

put(MediaStore.DownloadColumns.RELATIVE_PATH, Environment.DIRECTORY_DOWNLOADS)

put(MediaStore.DownloadColumns.IS_PENDING, true)

}

Is there a way that the contentValues cannot be tainted?. I believe the only way to use insert/update is using the contentValues.

Coming to the last flaw, I will try your solution and update here.

Thanks,

Ravikumargv

Hi Sounderya,

I can fix the third flaw at delete with your support.

Can you tell me,

How to insert/update without using contentValues? (this is specifically to update)

Regards,

Ravikumargv

Sorry for multiple messages.

I understood, there is no other way in using contentValues while inserting/updating.

Can you tell me how to sanitise/validate the inputs in this case?

Hello @RGandikota Venkata649492 (Community Member)​ ,

You can use a similar approach as the delete functionality mentioned in the previous example, for update and insert also.

Example:

// Defines an object to contain the updated values

val updateValues = ContentValues().apply {

    /*

     * Sets the updated value and updates the selected words.

     */

    putNull(UserDictionary.Words.LOCALE)

}

// Defines selection criteria for the rows you want to update

val selectionClause: String = UserDictionary.Words.LOCALE + "LIKE ?"

val selectionArgs: Array<String> = arrayOf("en_%")

// Defines a variable to contain the number of updated rows

var rowsUpdated: Int = 0

...

rowsUpdated = contentResolver.update(

        UserDictionary.Words.CONTENT_URI,   // the user dictionary content URI

        updateValues,                      // the columns to update

        selectionClause,                   // the column to select on

        selectionArgs                      // the value to compare to

)

Example Reference: https://developer.android.com/guide/topics/providers/content-provider-basics.html#Updating

If there are constraints in using that approach, yes, you must manually sanitize/validate each input, from which the taint is originating from. You can use a combination of a Regex (eg. a pattern of alphabets, numbers only) and a whitelisting approach( eg. a whitelist of valid mimeTypes) to sanitize your data.

Please note that implementing a custom sanitizing approach will require a manual "mitigation by design" on the Veracode Platform which will have to be reviewed and approved by your Application Security team. To raise a mitigation please refer: https://docs.veracode.com/r/improve_mitigation

Regards,

Sounderya