Question

对于用户输入，我正在使用@path变量传递值。当checkmarx验证我的代码时，提示SQL注入错误。

我尝试过添加null检查并使用正则表达式，但这些方法均无效。

 @RequestMapping(value = "/findData/{source}/{user}/{schema}/{table}", method = RequestMethod.GET)
        public @ResponseBody String findTableData(@PathVariable("source") String source, @PathVariable("user") String user,
                @PathVariable("schema") String schema, @PathVariable("table") String table) throws IOException {
            FormDataVO dataModel = new FormDataVO();
            TableInfoService tableInfoService = new TableInfoServiceImpl();
            String fileName="";
            if(null!=schema && null!= table){
             fileName = (source + "_" + schema).toUpperCase();
       List<TableDataVO> tableData = fileService.parseFile(fileName);
        for (int i = 0; i < tableData.size(); i++) {
            if (tableData.get(i).getTableName().equalsIgnoreCase(table)) {
                dataModel = getFormData(source, user);
                if (tableData.get(i).getUpdatedStatus().equalsIgnoreCase("false")) {
                    List<String> Pk_Incr_Size = tableInfoService.getTableData(dataModel, schema, table, false);
                    if (!Pk_Incr_Size.get(0).equals("#"))
                        tableData.get(i).setPrimaryKey(Pk_Incr_Size.get(0));
                    if (!Pk_Incr_Size.get(1).equals("#"))
                        tableData.get(i).setIncrementalColumn(Pk_Incr_Size.get(1));
                    if (Pk_Incr_Size.get(2).length() > 0)
                        tableData.get(i).setTableSize(Pk_Incr_Size.get(2));
                    tableData.get(i).setUpdatedStatus("true");
                    break;
                } else {
                    List<String> Pk_Incr_Size = tableInfoService.getTableData(dataModel, schema, table, true);
                    tableData.get(i).setTableSize(Pk_Incr_Size.get(0));
                }
              }
           }
          fileService.saveTables(fileName, tableData);
        }
        return fileService.getTableList().toJSONString();
    }

public class TableInfoServiceImpl implements TableInfoService{

        @Override
        public List<String> getTableData(FormDataVO FormDataVO, String schema,String table, boolean status) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getTableData(FormDataVO, schema,table, status,PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()));
        }

        @Override
        public String getSchemaNames(FormDataVO form) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getSchemaList(form, PasswordProcessorService.readPasswordFile(form.getPasswordLocation()));
        }

        @Override
        public List<TableDataVO> getTables(FormDataVO FormDataVO, String owner) throws FileNotFoundException, IOException {
            DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
            return dbQueryDAO.getTables(FormDataVO, PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()),owner);
        }

    @Override
    public List<TableDataVO> refreshTableList(FormDataVO FormDataVO, String lastModified, String owner)
            throws FileNotFoundException, IOException {
        DBQueryDAO dbQueryDAO=new DBQueryDAOImpl();
        return dbQueryDAO.getUpdatedTableData(FormDataVO, lastModified, PasswordProcessorService.readPasswordFile(FormDataVO.getPasswordLocation()),owner);
    }

}

此处从表格元素获取用户输入。然后，该元素的值会在未经适当清理或验证的情况下流经代码，最终会在getPK方法的数据库查询中使用。他可能会启用SQL注入攻击。这是我收到的错误消息。

Answer 1

尝试使用Encoder.encodeForSQL，这是Checkmarx明确寻找的消毒剂之一：

fileName = (ESAPI.encoder().encodeForSQL(source) + "_" + ESAPI.encoder().encodeForSQL(schema)).toUpperCase();

在其他用户输入中的实现方式

用户输入的SQL注入问题

1 个答案: