Uploaded image for project: 'RAML Module Builder'
  1. RAML Module Builder
  2. RMB-379

wrong Criteria value masking results in SQL Injection

    XMLWordPrintable

Details

    • CP: sprint 64
    • 2
    • Core: Platform

    Description

      org.folio.rest.persist.Criteria does not properly masks the value from setValue. The result must be a proper SQL String. The wrong masking results in SQL injection.

      Correct masking (and wrapping into single quotes):

      a -> 'a'
empty string -> ''

      Wrong masking (examples, this list is not complete):

      'a' -> expected '''a''', actual 'a'
O'Kapi -> expected 'O''Kapi', actual 'O'Kapi'
'' -> expected '''''', actual ''''
' -> expected '''', actual '''

      TestRail: Results

        Attachments

          Issue Links

            blocks

            Bug - A problem which impairs or prevents the functions of the product. UIU-835 Searching by Close Parens Generates Error

            • P3 - low priority level, item will be considered for inclusion in the next dev cycle
            • Closed
            relates to

            Bug - A problem which impairs or prevents the functions of the product. RMB-803 Fix URL encoding in BuildCQL preventing CQL injection

            • P3 - low priority level, item will be considered for inclusion in the next dev cycle
            • Closed

            Bug - A problem which impairs or prevents the functions of the product. RMB-199 Single quote SQL Injection in PostgresClient.delete(table, pojo, handler)

            • P2 - normal priority level, must be included in the current development cycle
            • Closed

            Bug - A problem which impairs or prevents the functions of the product. RMB-393 unit tests fail again

            • TBD - To be determined
            • Closed

            Activity

              People

                julianladisch Julian Ladisch
                julianladisch Julian Ladisch
                Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  TestRail: Runs

                    TestRail: Cases