Abhishek M (Community Member) asked a question.
Veracode is reporting - In this call to org.hibernate.Session.get, a data access statement could be executed with a primary key that can be controlled by externally provided values. If the provided primary key is not properly validated and the underlying storage does not restrict access to only entities that the user should be granted access to, it may be possible for an attacker to reference unauthorized records.
Consider the user input is "businessId" and I have to fetch the corresponding businessId value from db before passing this as primary key in db I have performed input validation by only allowing characters "[A-Za-z0-9_ ]+" and my user authorisation is already in place , still veracode is reporting the issue.
.png){kind=logo}
Hi,
If you are already validating that input 'businessId' is associated to the user 'userId' from logged in session, which confirms the relationship between the logged-in user and the business record to be fetched before the fetching of the record [call to org.hibernate.Session.get()] in addition to Regular expression based validation on the variable, you can propose it as Mitigation By Design.
You can also refer to this article.
https://community.veracode.com/s/article/forced-validation-paradigm
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif