Unsanitized external input in SQL query

  • Rule ID: java_spring_sqli
  • Languages: java
  • Source: sqli.yml

Description

Using unsanitized data, such as user input or request data, or externally influenced data passed to a function, in SQL query exposes your application to SQL injection attacks. This vulnerability arises when externally controlled data is directly included in SQL statements without proper sanitation, allowing attackers to manipulate queries and access or modify data.

Remediations

  • Do not concatenate external input directly into SQL queries. This practice can lead to SQL injection vulnerabilities.
    String query = "update user set name='"+uri.getQueryParameter("name")+"' where id='"+uri.getQueryParameter("userId")+"'";
    return jdbcTemplate.update(query);
  • Do use PreparedStatement with parameterized SQL queries to safely include external input. This method ensures that input is treated as data, not executable code.
    new PreparedStatementCreator() {
      public PreparedStatement createPreparedStatement(Connection conn) throws SQLException {
        String updateString = "update user set name = ? where id = ?";
        return conn.prepareStatement(updateString);
      }
    }

    new PreparedStatementSetter() {
      public void setValues(PreparedStatement preparedStatement) throws SQLException {
        preparedStatement.setString(1, uri.getQueryParameter("name"));
        preparedStatement.setInt(2, uri.getQueryParameter("userId"));
      }
    }

References

Associated CWE

OWASP Top 10

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=java_spring_sqli

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=java_spring_sqli