From 749ec055e9755f75d93fad8bb2ab4b7d6966aa48 Mon Sep 17 00:00:00 2001 From: Konstantin Golub Date: Tue, 17 Oct 2017 08:23:18 -0300 Subject: [PATCH] SQL injection validator fix --- .../security/utils/SQLInjectionValidator.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java index 60c207009..d03b2f460 100644 --- a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java +++ b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java @@ -30,7 +30,7 @@ public class SQLInjectionValidator { private final static String[] COMMENTS = { "--", "({", "/*", "#" }; - private final static String SQL_PATTERN = "[a-zA-Z_=,\\-'!><.?\"`% ()0-9]*"; + private final static String SQL_PATTERN = "[a-zA-Z_=,\\-'!><.?\"`% ()0-9*\n\r]*"; public final static void validateSQLInput(final String sqlSearch) { String lowerCaseSQL = sqlSearch.toLowerCase(); @@ -115,9 +115,9 @@ public class SQLInjectionValidator { } } public final static void validateAdhocQuery(final String sqlSearch) { - String lowerCaseSQL = sqlSearch.toLowerCase(); + String lowerCaseSQL = sqlSearch.toLowerCase().trim(); for (String ddl : DDL_COMMANDS) { - if (lowerCaseSQL.contains(ddl)) { + if (lowerCaseSQL.startsWith(ddl)) { throw new SQLInjectionException(); } }