SQL Injection issue for User Input

Question

For User Input i am passing the value using @path variable. When checkmarx validating my code giving SQL injection Error.

I have tried with addition of null check and using regex but non of these had worked.

 @RequestMapping(value = "/findData/{source}/{user}/{schema}/{table}", method = RequestMethod.GET)
        public @ResponseBody String findTableData(@PathVariable("source") String source, @PathVariable("user") String user,
                @PathVariable("schema") String schema, @PathVariable("table") String table) throws IOException {
            FormDataVO dataModel = new FormDataVO();
            TableInfoService tableInfoService = new TableInfoServiceImpl();
            String fileName="";
            if(null!=schema && null!= table){
             fileName = (source + "_" + schema).toUpperCase();
       List<TableDataVO> tableData = fileService.parseFile(fileName);
        for (int i = 0; i < tableData.size(); i++) {
            if (tableData.get(i).getTableName().equalsIgnoreCase(table)) {
                dataModel = getFormData(source, user);
                if (tableData.get(i).getUpdatedStatus().equalsIgnoreCase("false")) {
                    List<String> Pk_Incr_Size = tableInfoService.getTableData(dataModel, schema, table, false);
                    if (!Pk_Incr_Size.get(0).equals("#"))
                        tableData.get(i).setPrimaryKey(Pk_Incr_Size.get(0));
                    if (!Pk_Incr_Size.get(1).equals("#"))
                        tableData.get(i).setIncrementalColumn(Pk_Incr_Size.get(1));
                    if (Pk_Incr_Size.get(2).length() > 0)
                        tableData.get(i).setTableSize(Pk_Incr_Size.get(2));
                    tableData.get(i).setUpdatedStatus("true");
                    break;
                } else {
                    List<String> Pk_Incr_Size = tableInfoService.getTableData(dataModel, schema, table, true);
                    tableData.get(i).setTableSize(Pk_Incr_Size.get(0));
                }
              }
           }
          fileService.saveTables(fileName, tableData);
        }
        return fileService.getTableList().toJSONString();
    }

public class TableInfoServiceImpl implements TableInfoService{

        @Override
        public List<String> getTableData(FormDataVO FormDataVO, String schema,String table, boolean status) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getTableData(FormDataVO, schema,table, status,PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()));
        }

        @Override
        public String getSchemaNames(FormDataVO form) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getSchemaList(form, PasswordProcessorService.readPasswordFile(form.getPasswordLocation()));
        }

        @Override
        public List<TableDataVO> getTables(FormDataVO FormDataVO, String owner) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getTables(FormDataVO, PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()),owner);
        }

    @Override
    public List<TableDataVO> refreshTableList(FormDataVO FormDataVO, String lastModified, String owner)
            throws FileNotFoundException, IOException {
        DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
        return dbQueryDAO.getUpdatedTableData(FormDataVO, lastModified, PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()),owner);
    }

}

Here gets user input from the table element. This element’s value then flows through the code without being properly sanitized or validated, and is eventually used in a database query in method getPK. his may enable an SQL Injection attack. This is the error message i am getting.

Please include in your question the code of TableInfoServiceImpl and your data access code — eHayik, Jul 16 '19 at 07:00
Check if you're using PreparedStatements, https://stackoverflow.com/questions/1812891/java-escape-string-to-prevent-sql-injection — eHayik, Jul 16 '19 at 07:34

score 1 · Answer 1 · answered Sep 01 '19 at 20:17

Try using the Encoder.encodeForSQL which is one of the sanitizers that Checkmarx explicitly look for:

fileName = (ESAPI.encoder().encodeForSQL(source) + "_" + ESAPI.encoder().encodeForSQL(schema)).toUpperCase();

Implement likewise in the other user inputs

SQL Injection issue for User Input

1 Answers1