-
Notifications
You must be signed in to change notification settings - Fork 6
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Fixes issue where multiple mixed type injections were only fixed part…
…ially (#434)
- Loading branch information
1 parent
42f1f73
commit d2676e7
Showing
9 changed files
with
172 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
32 changes: 32 additions & 0 deletions
32
...test/resources/sonar-sql-injection-s2077/supportedMixedInjections/SQLTestMixed.java.after
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,32 @@ | ||
package io.codemodder.codemods; | ||
|
||
import java.sql.Connection; | ||
import java.sql.ResultSet; | ||
import java.sql.SQLException; | ||
import java.sql.Statement; | ||
import java.sql.PreparedStatement; | ||
import java.util.Scanner; | ||
import java.util.regex.Pattern; | ||
|
||
public final class SQLTestMixed { | ||
|
||
private Connection conn; | ||
|
||
public ResultSet simpleIndirect() throws SQLException { | ||
Scanner scanner = new Scanner(System.in); | ||
String input = scanner.nextLine(); | ||
String sql = "SELECT * FROM " + validateTableName(input + "") + " where name=?" ; | ||
PreparedStatement stmt = conn.prepareStatement(sql); | ||
stmt.setString(1, scanner.nextLine()); | ||
return stmt.execute(); | ||
} | ||
|
||
String validateTableName(final String tablename) { | ||
Pattern regex = Pattern.compile("[a-zA-Z0-9_]+(.[a-zA-Z0-9_]+)?"); | ||
if (!regex.matcher(tablename).matches()) { | ||
throw new SecurityException("Supplied table name contains non-alphanumeric characters"); | ||
} | ||
return tablename; | ||
} | ||
|
||
} |
24 changes: 24 additions & 0 deletions
24
...est/resources/sonar-sql-injection-s2077/supportedMixedInjections/SQLTestMixed.java.before
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,24 @@ | ||
package io.codemodder.codemods; | ||
|
||
import java.sql.Connection; | ||
import java.sql.ResultSet; | ||
import java.sql.SQLException; | ||
import java.sql.Statement; | ||
import java.sql.PreparedStatement; | ||
import java.util.Scanner; | ||
import java.util.regex.Pattern; | ||
|
||
public final class SQLTestMixed { | ||
|
||
private Connection conn; | ||
|
||
public ResultSet simpleIndirect() throws SQLException { | ||
Scanner scanner = new Scanner(System.in); | ||
String input = scanner.nextLine(); | ||
String input2 = scanner.nextLine(); | ||
String sql = "SELECT * FROM " + input + " where name='" + input2 + "'" ; | ||
Statement stmt = conn.createStatement(); | ||
return stmt.executeQuery(sql); | ||
} | ||
|
||
} |
48 changes: 48 additions & 0 deletions
48
...src/test/resources/sonar-sql-injection-s2077/supportedMixedInjections/sonar-hotspots.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,48 @@ | ||
{ | ||
"paging": { | ||
"pageIndex": 1, | ||
"pageSize": 100, | ||
"total": 1 | ||
}, | ||
"hotspots": [ | ||
{ | ||
"key": "AZEIpASKc7kK4RXktkeh", | ||
"component": "pixee_codemodder-java:core-codemods/src/main/java/io/codemodder/codemods/SQLTestMixed.java", | ||
"project": "pixee_codemodder-java", | ||
"securityCategory": "sql-injection", | ||
"vulnerabilityProbability": "HIGH", | ||
"status": "TO_REVIEW", | ||
"line": 21, | ||
"message": "Make sure using a dynamically formatted SQL query is safe here.", | ||
"creationDate": "2024-07-31T13:53:37+0200", | ||
"updateDate": "2024-07-31T13:53:37+0200", | ||
"textRange": { | ||
"startLine": 21, | ||
"endLine": 21, | ||
"startOffset": 33, | ||
"endOffset": 36 | ||
}, | ||
"flows": [], | ||
"ruleKey": "java:S2077" | ||
} | ||
], | ||
"components": [ | ||
{ | ||
"organization": "pixee", | ||
"key": "pixee_codemodder-java", | ||
"qualifier": "TRK", | ||
"name": "codemodder-java", | ||
"longName": "codemodder-java", | ||
"pullRequest": "434" | ||
}, | ||
{ | ||
"organization": "pixee", | ||
"key": "pixee_codemodder-java:core-codemods/src/main/java/io/codemodder/codemods/SQLTestMixed.java", | ||
"qualifier": "FIL", | ||
"name": "SQLTestMixed.java", | ||
"longName": "core-codemods/src/main/java/io/codemodder/codemods/SQLTestMixed.java", | ||
"path": "core-codemods/src/main/java/io/codemodder/codemods/SQLTestMixed.java", | ||
"pullRequest": "434" | ||
} | ||
] | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
37 changes: 37 additions & 0 deletions
37
...er-base/src/main/java/io/codemodder/remediation/sqlinjection/SQLInjectionFixComposer.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,37 @@ | ||
package io.codemodder.remediation.sqlinjection; | ||
|
||
import com.github.javaparser.ast.expr.MethodCallExpr; | ||
|
||
/** Composes several transformations related to SQL injections. */ | ||
public final class SQLInjectionFixComposer { | ||
|
||
private SQLInjectionFixComposer() {} | ||
|
||
/** | ||
* Given a {@link MethodCallExpr} related to executing JDBC API SQL queries (i.e. | ||
* prepareStatement(), executeQuery(), etc.), parameterize data injections or add a validation | ||
* step for structural injections. | ||
*/ | ||
public static boolean checkAndFix(final MethodCallExpr methodCallExpr) { | ||
// First, check if any data injection fixes apply | ||
var maybeFixed = new SQLParameterizer(methodCallExpr).checkAndFix(); | ||
if (maybeFixed.isPresent()) { | ||
// If yes, execute cleanup steps and check if any table injection remains. | ||
SQLParameterizerWithCleanup.cleanup(maybeFixed.get()); | ||
SQLTableInjectionFilterTransform.findAndFix(maybeFixed.get()); | ||
return true; | ||
// If not, try the table injection only | ||
} else { | ||
return SQLTableInjectionFilterTransform.findAndFix(methodCallExpr); | ||
} | ||
} | ||
|
||
/** | ||
* Check if the {@link MethodCallExpr} is a JDBC API query method that is a target of a SQL | ||
* injection transformation. | ||
*/ | ||
public static boolean match(final MethodCallExpr methodCallExpr) { | ||
return SQLParameterizer.isSupportedJdbcMethodCall(methodCallExpr) | ||
|| SQLTableInjectionFilterTransform.matchCall(methodCallExpr); | ||
} | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters