SQL injection remediation in existing project The 2019 Stack Overflow Developer Survey Results Are In Announcing the arrival of Valued Associate #679: Cesar Manara Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern) The Ask Question Wizard is Live! Data science time! April 2019 and salary with experienceHow to execute a stored procedure within C# programHow can I prevent SQL injection in PHP?How do I perform an IF…THEN in an SQL SELECT?Add a column with a default value to an existing table in SQL ServerHow to return only the Date from a SQL Server DateTime datatypeHow to concatenate text from multiple rows into a single text string in SQL server?Inserting multiple rows in a single SQL query?How do I UPDATE from a SELECT in SQL Server?Finding duplicate values in a SQL tableSQL injection that gets around mysql_real_escape_string()How to import an SQL file using the command line in MySQL?
Is a pteranodon too powerful as a beast companion for a beast master?
Why does the Event Horizon Telescope (EHT) not include telescopes from Africa, Asia or Australia?
Semisimplicity of the category of coherent sheaves?
What can I do if neighbor is blocking my solar panels intentionally?
Do working physicists consider Newtonian mechanics to be "falsified"?
Take groceries in checked luggage
Can withdrawing asylum be illegal?
Is it ok to offer lower paid work as a trial period before negotiating for a full-time job?
Am I ethically obligated to go into work on an off day if the reason is sudden?
RT6224D-based step down circuit yields 0V - why?
What do you call a plan that's an alternative plan in case your initial plan fails?
Difference between "generating set" and free product?
Why don't hard Brexiteers insist on a hard border to prevent illegal immigration after Brexit?
Grover's algorithm - DES circuit as oracle?
Can a 1st-level character have an ability score above 18?
Why did all the guest students take carriages to the Yule Ball?
What was the last x86 CPU that did not have the x87 floating-point unit built in?
Derivation tree not rendering
Does the AirPods case need to be around while listening via an iOS Device?
Still taught to reverse oxidation half cells in electrochemistry?
How to test the equality of two Pearson correlation coefficients computed from the same sample?
How to delete random line from file using Unix command?
Mortgage adviser recommends a longer term than necessary combined with overpayments
Short and long uuids under /dev/disk/by-uuid
SQL injection remediation in existing project
The 2019 Stack Overflow Developer Survey Results Are In
Announcing the arrival of Valued Associate #679: Cesar Manara
Planned maintenance scheduled April 17/18, 2019 at 00:00UTC (8:00pm US/Eastern)
The Ask Question Wizard is Live!
Data science time! April 2019 and salary with experienceHow to execute a stored procedure within C# programHow can I prevent SQL injection in PHP?How do I perform an IF…THEN in an SQL SELECT?Add a column with a default value to an existing table in SQL ServerHow to return only the Date from a SQL Server DateTime datatypeHow to concatenate text from multiple rows into a single text string in SQL server?Inserting multiple rows in a single SQL query?How do I UPDATE from a SELECT in SQL Server?Finding duplicate values in a SQL tableSQL injection that gets around mysql_real_escape_string()How to import an SQL file using the command line in MySQL?
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
This is my first question in this forum,
We are supporting Spring & Hibernate framework applications, recently scan happened in existing code (more than 6 years of code) as part of security process.
Identified SQL injection vulnerability in those applications around 5. There are many places this happend like below
StringBuffer sb = new StringBuffer();
FormBean searchcriteria= new FormBean();
sb.append(" SELECT * FROM VW_VIEW1 WHERE COLUMN1 IN (")
.append(" SELECT ID FROM VW_VIEW2 WHERE (")
.append(" COLUMN1 =:NAME OR COLUMN2 IN (SELECT COLUMN2 FROM TABLE WHERE COLUMN3 = :NAME ) AND COLUMN2 IS NOT NULL)))");
if (searchcriteria !=null)
**fillCriteria (criteria,sb);**
sb.append(" order by ").append(csort).append(" ").append(csorty);
Query query=session.createSQLQuery(sb.toString()).setParameter("NAME" "MYNAME");
return query.list();
Here problem fillCriteria has many where clause columns based on user selection this works sample code of the method shows below
private void fillCriteria(FORMBEAN criteria,StringBuffer sb)
Helper.addCriterionClause(sb, " and lower(Table_ID) like ",criteria.ID);
Helper.addCriterionClause(sb, " and lower(Table_ID1) like ",criteria.ID1);
Helper.addCriterionClause(sb, " and lower(Table_ID2) like ",criteria.ID2);
Helper.addCriterionClause(sb, " and lower(Table_ID3) like ",criteria.ID3);
Helper.addCriterionClause(sb, " and lower(Table_ID4) like ",criteria.ID4);
Helper.addCriterionClause(sb, " and lower(Table_ID5) like ",criteria.ID5);
Helper.addCriterionClause(sb, " and lower(Table_ID6) like ",criteria.ID6);
Helper.addCriterionClause(sb, " and lower(Table_ID7) like ",criteria.ID7);
like these 20 - 30 clauses are there. This is one method in class, I have tens of methods in each class, tens of class in each app. I dont want to redefined all these methods now as i dont have time and resource.
Can you please suggest to handle these types of issues to remediate SQL injection in one places instead of changing all code. with Minimal code change how can i handle this
Your response is greatly appreciated
sql hibernate code-injection sample
asked Mar 22 at 6:07
cnscns
111
add a comment |
This is my first question in this forum,
We are supporting Spring & Hibernate framework applications, recently scan happened in existing code (more than 6 years of code) as part of security process.
Identified SQL injection vulnerability in those applications around 5. There are many places this happend like below
StringBuffer sb = new StringBuffer();
FormBean searchcriteria= new FormBean();
sb.append(" SELECT * FROM VW_VIEW1 WHERE COLUMN1 IN (")
.append(" SELECT ID FROM VW_VIEW2 WHERE (")
.append(" COLUMN1 =:NAME OR COLUMN2 IN (SELECT COLUMN2 FROM TABLE WHERE COLUMN3 = :NAME ) AND COLUMN2 IS NOT NULL)))");
if (searchcriteria !=null)
**fillCriteria (criteria,sb);**
sb.append(" order by ").append(csort).append(" ").append(csorty);
Query query=session.createSQLQuery(sb.toString()).setParameter("NAME" "MYNAME");
return query.list();
Here problem fillCriteria has many where clause columns based on user selection this works sample code of the method shows below
private void fillCriteria(FORMBEAN criteria,StringBuffer sb)
Helper.addCriterionClause(sb, " and lower(Table_ID) like ",criteria.ID);
Helper.addCriterionClause(sb, " and lower(Table_ID1) like ",criteria.ID1);
Helper.addCriterionClause(sb, " and lower(Table_ID2) like ",criteria.ID2);
Helper.addCriterionClause(sb, " and lower(Table_ID3) like ",criteria.ID3);
Helper.addCriterionClause(sb, " and lower(Table_ID4) like ",criteria.ID4);
Helper.addCriterionClause(sb, " and lower(Table_ID5) like ",criteria.ID5);
Helper.addCriterionClause(sb, " and lower(Table_ID6) like ",criteria.ID6);
Helper.addCriterionClause(sb, " and lower(Table_ID7) like ",criteria.ID7);
like these 20 - 30 clauses are there. This is one method in class, I have tens of methods in each class, tens of class in each app. I dont want to redefined all these methods now as i dont have time and resource.
Can you please suggest to handle these types of issues to remediate SQL injection in one places instead of changing all code. with Minimal code change how can i handle this
Your response is greatly appreciated
sql hibernate code-injection sample
asked Mar 22 at 6:07
cnscns
111
You can still keep the criteria method but you’ll have to switch to stored procedure instead of building a query string
– Davide Vitali
Mar 22 at 6:58
Thanks Davide for your reply, can you please send some sample code how to call stored procedure in this scenario.
– cns
Mar 23 at 7:31
this answer to programmatically execute them within your methods.
– Davide Vitali
Mar 23 at 7:58
add a comment |
This is my first question in this forum,
We are supporting Spring & Hibernate framework applications, recently scan happened in existing code (more than 6 years of code) as part of security process.
Identified SQL injection vulnerability in those applications around 5. There are many places this happend like below
StringBuffer sb = new StringBuffer();
FormBean searchcriteria= new FormBean();
sb.append(" SELECT * FROM VW_VIEW1 WHERE COLUMN1 IN (")
.append(" SELECT ID FROM VW_VIEW2 WHERE (")
.append(" COLUMN1 =:NAME OR COLUMN2 IN (SELECT COLUMN2 FROM TABLE WHERE COLUMN3 = :NAME ) AND COLUMN2 IS NOT NULL)))");
if (searchcriteria !=null)
**fillCriteria (criteria,sb);**
sb.append(" order by ").append(csort).append(" ").append(csorty);
Query query=session.createSQLQuery(sb.toString()).setParameter("NAME" "MYNAME");
return query.list();
Here problem fillCriteria has many where clause columns based on user selection this works sample code of the method shows below
private void fillCriteria(FORMBEAN criteria,StringBuffer sb)
Helper.addCriterionClause(sb, " and lower(Table_ID) like ",criteria.ID);
Helper.addCriterionClause(sb, " and lower(Table_ID1) like ",criteria.ID1);
Helper.addCriterionClause(sb, " and lower(Table_ID2) like ",criteria.ID2);
Helper.addCriterionClause(sb, " and lower(Table_ID3) like ",criteria.ID3);
Helper.addCriterionClause(sb, " and lower(Table_ID4) like ",criteria.ID4);
Helper.addCriterionClause(sb, " and lower(Table_ID5) like ",criteria.ID5);
Helper.addCriterionClause(sb, " and lower(Table_ID6) like ",criteria.ID6);
Helper.addCriterionClause(sb, " and lower(Table_ID7) like ",criteria.ID7);
like these 20 - 30 clauses are there. This is one method in class, I have tens of methods in each class, tens of class in each app. I dont want to redefined all these methods now as i dont have time and resource.
Can you please suggest to handle these types of issues to remediate SQL injection in one places instead of changing all code. with Minimal code change how can i handle this
Your response is greatly appreciated
sql hibernate code-injection sample
asked Mar 22 at 6:07
cnscns
111
This is my first question in this forum,
We are supporting Spring & Hibernate framework applications, recently scan happened in existing code (more than 6 years of code) as part of security process.
Identified SQL injection vulnerability in those applications around 5. There are many places this happend like below
StringBuffer sb = new StringBuffer();
FormBean searchcriteria= new FormBean();
sb.append(" SELECT * FROM VW_VIEW1 WHERE COLUMN1 IN (")
.append(" SELECT ID FROM VW_VIEW2 WHERE (")
.append(" COLUMN1 =:NAME OR COLUMN2 IN (SELECT COLUMN2 FROM TABLE WHERE COLUMN3 = :NAME ) AND COLUMN2 IS NOT NULL)))");
if (searchcriteria !=null)
**fillCriteria (criteria,sb);**
sb.append(" order by ").append(csort).append(" ").append(csorty);
Query query=session.createSQLQuery(sb.toString()).setParameter("NAME" "MYNAME");
return query.list();
Here problem fillCriteria has many where clause columns based on user selection this works sample code of the method shows below
private void fillCriteria(FORMBEAN criteria,StringBuffer sb)
Helper.addCriterionClause(sb, " and lower(Table_ID) like ",criteria.ID);
Helper.addCriterionClause(sb, " and lower(Table_ID1) like ",criteria.ID1);
Helper.addCriterionClause(sb, " and lower(Table_ID2) like ",criteria.ID2);
Helper.addCriterionClause(sb, " and lower(Table_ID3) like ",criteria.ID3);
Helper.addCriterionClause(sb, " and lower(Table_ID4) like ",criteria.ID4);
Helper.addCriterionClause(sb, " and lower(Table_ID5) like ",criteria.ID5);
Helper.addCriterionClause(sb, " and lower(Table_ID6) like ",criteria.ID6);
Helper.addCriterionClause(sb, " and lower(Table_ID7) like ",criteria.ID7);
like these 20 - 30 clauses are there. This is one method in class, I have tens of methods in each class, tens of class in each app. I dont want to redefined all these methods now as i dont have time and resource.
Can you please suggest to handle these types of issues to remediate SQL injection in one places instead of changing all code. with Minimal code change how can i handle this
Your response is greatly appreciated
sql hibernate code-injection sample
sql hibernate code-injection sample
asked Mar 22 at 6:07
cnscns
111
asked Mar 22 at 6:07
cnscns
111
asked Mar 22 at 6:07
cnscns
111
asked Mar 22 at 6:07
cnscns
111
asked Mar 22 at 6:07
cnscns
111
111
You can still keep the criteria method but you’ll have to switch to stored procedure instead of building a query string
– Davide Vitali
Mar 22 at 6:58
Thanks Davide for your reply, can you please send some sample code how to call stored procedure in this scenario.
– cns
Mar 23 at 7:31
this answer to programmatically execute them within your methods.
– Davide Vitali
Mar 23 at 7:58
add a comment |
You can still keep the criteria method but you’ll have to switch to stored procedure instead of building a query string
– Davide Vitali
Mar 22 at 6:58
Thanks Davide for your reply, can you please send some sample code how to call stored procedure in this scenario.
– cns
Mar 23 at 7:31
this answer to programmatically execute them within your methods.
– Davide Vitali
Mar 23 at 7:58
You can still keep the criteria method but you’ll have to switch to stored procedure instead of building a query string
– Davide Vitali
Mar 22 at 6:58
You can still keep the criteria method but you’ll have to switch to stored procedure instead of building a query string
– Davide Vitali
Mar 22 at 6:58
Thanks Davide for your reply, can you please send some sample code how to call stored procedure in this scenario.
– cns
Mar 23 at 7:31
Thanks Davide for your reply, can you please send some sample code how to call stored procedure in this scenario.
– cns
Mar 23 at 7:31
this answer to programmatically execute them within your methods.
– Davide Vitali
Mar 23 at 7:58
this answer to programmatically execute them within your methods.
– Davide Vitali
Mar 23 at 7:58
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55293802%2fsql-injection-remediation-in-existing-project%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f55293802%2fsql-injection-remediation-in-existing-project%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
You can still keep the criteria method but you’ll have to switch to stored procedure instead of building a query string
– Davide Vitali
Mar 22 at 6:58
Thanks Davide for your reply, can you please send some sample code how to call stored procedure in this scenario.
– cns
Mar 23 at 7:31
this answer to programmatically execute them within your methods.
– Davide Vitali
Mar 23 at 7:58