Re: sql injection regression?

On Thu, 26 Jul 2007, Bill Pugh wrote:

> I'll look into it. We've been making a bunch of internal changes, but
> hadn't intended any changes to the sql injection results.

Great, thanks! I noticed that the last version it worked in was 1.1.3 --
it hasn't worked in 1.2 or 1.2.1. Which is weird because the changes I
made in that area used this test as the baseline.

> One thing I did notice is that the example isn't a typical SQL
> injection, and that will lower the priority of the warning:
>
>            public void truePositive(Statement query) throws
> SQLException {
>                  query.executeQuery("select * from " +
> request.getParameter("ANIMAL"));
>          }
>
> When we see string concatenation with the use of ' characters, the
> priority goes up.
>
>            public void higherPriorityTruePositive(Statement query)
> throws SQLException {
>                  query.executeQuery("select * from zoo where animal='"
>                    + request.getParameter("ANIMAL") +"'");
>          }
>

Good point! I'll fix this and be sure to mention it in the class.


> But still, the other should still get flagged.
> I should get back to you later today.

Thanks, Bill! :)


--
tangled strands of DNA explain the way that I behave.
http://www.clock.org/~matt