CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 46 Packages Projects Releases Wiki Activity

SQL injection validator fix

Browse Source
This commit is contained in:
Konstantin Golub
2017-10-17 08:23:18 -03:00
parent 87e0c59fb3
commit 749ec055e9
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
+3 -3
View File
@@ -30,7 +30,7 @@ public class SQLInjectionValidator {
private final static String[] COMMENTS = { "--", "({", "/*", "#" }; private final static String[] COMMENTS = { "--", "({", "/*", "#" };
private final static String SQL_PATTERN = "[a-zA-Z_=,\\-'!><.?\"`% ()0-9]*"; private final static String SQL_PATTERN = "[a-zA-Z_=,\\-'!><.?\"`% ()0-9*\n\r]*";
public final static void validateSQLInput(final String sqlSearch) { public final static void validateSQLInput(final String sqlSearch) {
String lowerCaseSQL = sqlSearch.toLowerCase(); String lowerCaseSQL = sqlSearch.toLowerCase();
@@ -115,9 +115,9 @@ public class SQLInjectionValidator {
} }
} }
public final static void validateAdhocQuery(final String sqlSearch) { public final static void validateAdhocQuery(final String sqlSearch) {
String lowerCaseSQL = sqlSearch.toLowerCase(); String lowerCaseSQL = sqlSearch.toLowerCase().trim();
for (String ddl : DDL_COMMANDS) { for (String ddl : DDL_COMMANDS) {
if (lowerCaseSQL.contains(ddl)) { if (lowerCaseSQL.startsWith(ddl)) {
throw new SQLInjectionException(); throw new SQLInjectionException();
} }
} }