Unsanitized external input in SQL query

  • Rule ID: java_lang_sqli
  • Languages: java
  • Source: sqli.yml

Description

Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.

Remediations

  • Do not include unsanitized input in SQL queries. This practice can lead to SQL injection vulnerabilities.
    Statement stmt = conn.createStatement();
    ResultSet rs = stmt.executeQuery("select name from users where id='" + uri.getQueryParameter("user_id") + "'"));
  • Do use prepared statements for SQL queries to safely include external input.
    PreparedStatement myStmt = myCon.prepareStatement("select * from students where age > ? and name = ?");
    myStmt.setInt(1, uri.getQueryParameter("age"));
    myStmt.setString(2, uri.getQueryParameter("name"));

References

Associated CWE

OWASP Top 10

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=java_lang_sqli

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=java_lang_sqli