OWASP Top 10 number 2: Injection Flaws Number 2 in the Top 10 most critical web application security vulnerabilitiesidentified by the Open Web Application Security Project (OWASP) is Injection Flaws. Injection happens whenever an attacker's data is able to modify a query or command sent to a database, LDAP server, operating system or other Interpreter. Types of injections are SQL, LDAP, XPath, XSLT, HTML, XML, OS command... SQL injection and Cross-Site Scripting account for more than 80% of the vulnerabilities being discovered against Web applications (SANS Top Cyber Security Risks).
SQL Injection Exampleuse of string concantenation to build query: SQL Injection can happen with dynamic database queries concatenated with user supplied input, for example with the following query:
"select * from MYTABLE where name=" + parameter
"select * from MYTABLE where name= 'name' OR 'a'='a';
"select * from MYTABLE;
"select * from MYTABLE where name= 'name' OR 'a'='a'; delete from MYTABLE;
"select * from MYTABLE; delete from MYTABLE;
SQL Injection can be used to:
- create , read , update, or delete database data
Protecting against SQL Injection
- Don't concatenate user input data to a query or command!
- Use Query Parameter binding with typed parameters, this ensures the input data can only be interpreted as the value for the intended parameter so the attacker can not change the intent of a query.
- Validate all input data to the application using white list (what is allowed) for type, format, length, range, reject if invalid. (see previous blog entry)
- don't provide too much information in error messages (like SQL Exception Information, table names..) to the user.
Java specific Protecting against SQL Injection
Don't concatenate user input data to a query or command:
- Don't do this with JDBC:
String empId= req.getParameter("empId") // input parameter
String query = "SELECT * FROM Employee WHERE
id = '" + empId +"'"?
- Don't do this with JPA:
q = entityManager.createQuery(