如何修复SQL注入veracode问题-CWE 564

Question

@Override
public AssetLibraryReference selectALRefByName(String entityName,String name) throws Exception {
    AssetLibraryReference returnRef = null;
    String query = "from " + entityName + " where name = :name ";
    
    try {
        returnRef = sessionQueryUtil.doSessionQuery(session -> {
        //  queryStr.append("from " + entityName + " where name = :name ");             
            
          Query q =  session.createQuery(query);
                  q.setString("name", name);    
            
            
            return (AssetLibraryReference)q.uniqueResult();
        });
    } catch (HibernateException e) {
        LOG.error ("Caught hibernate exception",e);
        e.printStackTrace();
        throw e;
    } catch (Exception e) {
        LOG.error("Caught Exception :"+e.getMessage());
        e.printStackTrace();
        throw e;
    }

    return returnRef;
}

在查询q=session.createquery（query）；处出现veracode扫描错误。有人能帮我解决这个问题吗。我可以在这里用什么来解决这个问题。veracode问题id是CWE 564。

Answer 1

使用Query.SetParameter使name成为防止SQL注入的命名参数

@Override
public AssetLibraryReference selectALRefByName(String entityName,String name) throws Exception {
    AssetLibraryReference returnRef = null;
    String query = "from " + entityName + " where name = :name ";
    
    try {
        returnRef = sessionQueryUtil.doSessionQuery(session -> {
        //  queryStr.append("from " + entityName + " where name = :name ");             
            
          Query q =  session.createQuery(query);
                  q.setParameter("name", name);    
            
            
            return (AssetLibraryReference)q.uniqueResult();
        });
    } catch (HibernateException e) {
        LOG.error ("Caught hibernate exception",e);
        e.printStackTrace();
        throw e;
    } catch (Exception e) {
        LOG.error("Caught Exception :"+e.getMessage());
        e.printStackTrace();
        throw e;
    }

    return returnRef;
}