Checkmarx Postgres查询形成错误SQL注入错误SQL二阶注入错误Java Springboot

Question

我有一些执行数据库操作API。每当我将代码上传到checkmarx时，我会得到以下错误，并将其标记为高漏洞错误，有人能帮助我吗？

应用程序的CreateDatabaseAndMapToDomain方法使用executeQuery执行SQL查询，位于daas-springboot-checkmarxintegration\src\main\java\com\it\daas\apis\service\PostgresConnectionServiceImpl.java的第717行。应用程序通过将不受信任的字符串嵌入到查询中而不进行适当的清理来构造此SQL查询。串联的字符串被提交到数据库，在数据库中进行相应的解析和执行。

攻击者可以将任意数据写入数据库，然后由应用程序在getDomains方法中使用executeQuery检索这些数据，该方法位于daas-springboot-checkMarxIntegration\src\main\java\com\it\daas\apis\service\PostgresConnectionServiceImpl.java的第678行。然后，这些数据流过代码，直到它不经处理直接在SQL查询中使用，然后提交给数据库服务器执行

这是我的功能

    @Override
public String getDomains() throws SQLException {

    String domainquery = "SELECT id,domain FROM domain";
    Connection con = null;
    PreparedStatement st = null;
    ResultSet result = null;
    try
    {
        con = ConnectToPostgresapibuilderDatabase(apibuilderConnectionString, apibuilderUserName,apibuilderPassword);
        con.setSchema(this.schema);
        st = con.prepareStatement(domainquery);
        result = st.executeQuery();

        ArrayList<DatabaseDomainBean> list = new ArrayList<DatabaseDomainBean>();
        while (result.next()) {
            list.add(new DatabaseDomainBean(result.getString("domain"), result.getString("id")));
        }
        return new JSONObject().put("domainlist", list).toString();


    }
    catch(Exception e)
    {

        e.printStackTrace();
        return null;
    }
    finally{

        result.close();
        st.close();
        con.close();

    }


}

@Override
public String CreateDatabaseAndMapToDomain(String database, String[] domainIds, String password)
        throws SQLException {

    if (!this.apibuilderPassword.equals(password)) {
        return null;
    }
    else if(database==null || domainIds==null || password ==null)
    {
        return "Failure";
    }


    Connection con =null;
    PreparedStatement st =null;
    ResultSet ispresent =null;
    PreparedStatement mapquerystmnt =null;
    ResultSet resultMapping = null;

    try
    {
        con = ConnectToPostgresapibuilderDatabase(apibuilderConnectionString, apibuilderUserName,apibuilderPassword);
        con.setSchema(this.schema);

        for (int i = 0; i < domainIds.length; i++) {

            con.setSchema(this.schema);

            String IfExists = MessageFormat.format(
                    "SELECT databasename,domainid FROM Databases WHERE databasename IN (?) AND domainid IN (?)",
                    Utilitymethods.ConvertToMessageFormatCompatibleForm(database),
                    Utilitymethods.ConvertToMessageFormatCompatibleForm(domainIds[i]));

            st = con.prepareStatement(IfExists);
            st.setString(1, database);
            st.setInt(2, Integer.parseInt(domainIds[i]));
            ispresent = st.executeQuery();

            if (!ispresent.next()) {
                // INSERT INTO Databases (databasename,domainid) VALUES ('Teradata','1')
                String mapquery = MessageFormat.format(
                        "INSERT INTO Databases (databasename,domainid) VALUES (?,?) returning Id",
                        Utilitymethods.ConvertToMessageFormatCompatibleForm(database),
                        Utilitymethods.ConvertToMessageFormatCompatibleForm(domainIds[i]));
                 mapquerystmnt = con.prepareStatement(mapquery);
                 mapquerystmnt.setString(1, database);
                 mapquerystmnt.setInt(2, Integer.parseInt(domainIds[i]));
                 resultMapping =  mapquerystmnt.executeQuery();
            }

        }

        return "Success";

    }
    catch(Exception e)
    {
        e.printStackTrace();
        return "Failure";

    }
    finally
    {

        ispresent.close();
        st.close();
        resultMapping.close();
        mapquerystmnt.close();
        con.close();
    }





}


@Override
public String getDomains() throws SQLException {

    String domainquery = "SELECT id,domain FROM domain";
    Connection con = null;
    PreparedStatement st = null;
    ResultSet result = null;
    try
    {
        con = ConnectToPostgresapibuilderDatabase(apibuilderConnectionString, apibuilderUserName,apibuilderPassword);
        con.setSchema(this.schema);
        st = con.prepareStatement(domainquery);
        result = st.executeQuery();

        ArrayList<DatabaseDomainBean> list = new ArrayList<DatabaseDomainBean>();
        while (result.next()) {
            list.add(new DatabaseDomainBean(result.getString("domain"), result.getString("id")));
        }
        return new JSONObject().put("domainlist", list).toString();


    }
    catch(Exception e)
    {

        e.printStackTrace();
        return null;
    }
    finally{

        result.close();
        st.close();
        con.close();

    }


}

Answer 1

直接使用st=con.prepareStatement（“select id,domain FROM domain”）尝试。由于字符串domainquery=“select id,domain FROM domain”语句和sql注入的可能性，checkmarx看起来很困惑。