DJOSEPH740579 (Community Member) asked a question.
ALTER TABLE ADD COLUMN columnName columnTyoe
ALTER TABLE DROP COLUMN columnName
How to write both these queries using SpringBoot & hibernate jpa and there should not be any flaws in Veracode scan?
ALTER TABLE DROP COLUMN columnName
How to write both these queries using SpringBoot & hibernate jpa and there should not be any flaws in Veracode scan?
How to avoid SQL Injection for these queries from Veracode scan
ALTER TABLE ADD COLUMN columnName columnTyoe
ALTER TABLE DROP COLUMN columnName
Frameworks used are SpringBoot, Hibernate JPA
.png){kind=logo}
Hi @DJOSEPH740579 (Community Member) Please reach out to our team and request a consultation, we can give you better feedback on the call - https://docs.veracode.com/r/t_schedule_consultation
Hello @DJOSEPH740579 (Community Member) ,
For the two queries you provided, the concern of SQL injection occurs based on not properly handling and validating the columnName and columnType variables where the Veracode scanner can find evidence of external tainted input making its way into these variable (e.g. input comes from a web request, database, file, runtime environment, etc.).
Ideally, we would want these queries to be written so these values are hardcoded and not accepting any externally identified input to not receive a flaw. However, if the use case of these queries requires accepting tainted outside input, then you will want to ensure that there is proper allow-list input validation of these variables to ensure that only appropriate columnName and columnType values are accepted. We will have to rely on input validation here as these parts of the SQL query are unable to make use of parameterized prepared statements and bind variables -- parameterization can only work on values in the SQL query, but not with any SQL structure identifiers such as column/table names or types.
Please also refer to the following Veracode guides and OWASP cheat sheet for more information on this recommendation:
Please note that Veracode static analysis is unable to understand or evaluate allow-list input validation checks in the code or as part of your runtime as part of a static scan. After you've added the validation checks and confirmed these work as intended for your query use case, please enter a mitigation proposal for these flaws to document the validation checks you have in place to ensure expected, valid inputs. Please refer to the following documentation links below for how to enter a mitigation proposal and how to resolve these flaws using this option:
After entering a mitigation proposal for these flaws, please connect with your organization's security team admins for getting these proposals reviewed and approved.
Should you still have any additional questions or would like to discuss/understand these flaws further, then please make use of @SamHouston (Veracode) suggestion to schedule a consultation call with our team by following the instructions in that link.
Best Regards,
Andrew Bell