0

对于用户输入，我使用@path 变量传递值。当 checkmarx 验证我的代码时给出 SQL 注入错误。

我尝试过添加空检查并使用正则表达式，但这些都没有奏效。

 @RequestMapping(value = "/findData/{source}/{user}/{schema}/{table}", method = RequestMethod.GET)
        public @ResponseBody String findTableData(@PathVariable("source") String source, @PathVariable("user") String user,
                @PathVariable("schema") String schema, @PathVariable("table") String table) throws IOException {
            FormDataVO dataModel = new FormDataVO();
            TableInfoService tableInfoService = new TableInfoServiceImpl();
            String fileName="";
            if(null!=schema && null!= table){
             fileName = (source + "_" + schema).toUpperCase();
       List<TableDataVO> tableData = fileService.parseFile(fileName);
        for (int i = 0; i < tableData.size(); i++) {
            if (tableData.get(i).getTableName().equalsIgnoreCase(table)) {
                dataModel = getFormData(source, user);
                if (tableData.get(i).getUpdatedStatus().equalsIgnoreCase("false")) {
                    List<String> Pk_Incr_Size = tableInfoService.getTableData(dataModel, schema, table, false);
                    if (!Pk_Incr_Size.get(0).equals("#"))
                        tableData.get(i).setPrimaryKey(Pk_Incr_Size.get(0));
                    if (!Pk_Incr_Size.get(1).equals("#"))
                        tableData.get(i).setIncrementalColumn(Pk_Incr_Size.get(1));
                    if (Pk_Incr_Size.get(2).length() > 0)
                        tableData.get(i).setTableSize(Pk_Incr_Size.get(2));
                    tableData.get(i).setUpdatedStatus("true");
                    break;
                } else {
                    List<String> Pk_Incr_Size = tableInfoService.getTableData(dataModel, schema, table, true);
                    tableData.get(i).setTableSize(Pk_Incr_Size.get(0));
                }
              }
           }
          fileService.saveTables(fileName, tableData);
        }
        return fileService.getTableList().toJSONString();
    }

public class TableInfoServiceImpl implements TableInfoService{

        @Override
        public List<String> getTableData(FormDataVO FormDataVO, String schema,String table, boolean status) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getTableData(FormDataVO, schema,table, status,PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()));
        }

        @Override
        public String getSchemaNames(FormDataVO form) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getSchemaList(form, PasswordProcessorService.readPasswordFile(form.getPasswordLocation()));
        }

        @Override
        public List<TableDataVO> getTables(FormDataVO FormDataVO, String owner) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getTables(FormDataVO, PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()),owner);
        }

    @Override
    public List<TableDataVO> refreshTableList(FormDataVO FormDataVO, String lastModified, String owner)
            throws FileNotFoundException, IOException {
        DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
        return dbQueryDAO.getUpdatedTableData(FormDataVO, lastModified, PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()),owner);
    }

}

这里从表格元素获取用户输入。然后，该元素的值在没有经过适当清理或验证的情况下流经代码，最终在方法 getPK 中的数据库查询中使用。他可能会启用 SQL 注入攻击。这是我收到的错误消息。

4

1 回答 1

1

尝试使用Encoder.encodeForSQL，它是 Checkmarx 明确寻找的消毒剂之一：

fileName = (ESAPI.encoder().encodeForSQL(source) + "_" + ESAPI.encoder().encodeForSQL(schema)).toUpperCase();

在其他用户输入中同样实现

于 2019-09-01T20:17:36.287 回答