CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 37 Packages Projects Releases Wiki Activity

FINERACT-1724: Refactoring SQLInjectionValidator

Browse Source
This commit is contained in:
woony-kim
2023-07-27 15:22:19 +02:00
committed by Adam Saghy
parent ea172db712
commit aaddb3141c
2 changed files with 44 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java
+24
View File
@@ -0,0 +1,24 @@
/**
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.fineract.infrastructure.security.utils;
public interface SQLCommandCondition {
boolean checkCondition(String command, String sql);
}
fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
+20 -45
View File
@@ -18,6 +18,7 @@
*/
package org.apache.fineract.infrastructure.security.utils;
import java.util.List;
import java.util.StringTokenizer;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -42,23 +43,8 @@ public final class SQLInjectionValidator {
return;
}
String lowerCaseSQL = sqlSearch.toLowerCase();
for (String ddl : DDL_COMMANDS) {
if (lowerCaseSQL.contains(ddl)) {
throw new SQLInjectionException();
}
}
for (String dml : DML_COMMANDS) {
if (lowerCaseSQL.contains(dml)) {
throw new SQLInjectionException();
}
}
for (String comments : COMMENTS) {
if (lowerCaseSQL.contains(comments)) {
throw new SQLInjectionException();
}
}
List<String[]> commandsList = List.of(DDL_COMMANDS, DML_COMMANDS, COMMENTS);
validateSQLCommands(lowerCaseSQL, commandsList, String::contains);
patternMatchSqlInjection(sqlSearch, lowerCaseSQL);
}
@@ -68,17 +54,8 @@ public final class SQLInjectionValidator {
return;
}
String lowerCaseSQL = sqlSearch.toLowerCase().trim();
for (String ddl : DDL_COMMANDS) {
if (lowerCaseSQL.startsWith(ddl)) {
throw new SQLInjectionException();
}
}
for (String comments : COMMENTS) {
if (lowerCaseSQL.contains(comments)) {
throw new SQLInjectionException();
}
}
validateSQLCommand(lowerCaseSQL, DDL_COMMANDS, String::startsWith);
validateSQLCommand(lowerCaseSQL, COMMENTS, String::contains);
// Removing the space before and after '=' operator
// String s = " \" OR 1 = 1"; For the cases like this
@@ -91,23 +68,8 @@ public final class SQLInjectionValidator {
}
String lowerCaseSQL = sqlSearch.toLowerCase();
for (String ddl : DDL_COMMANDS) {
if (ddl.equals(lowerCaseSQL)) {
throw new SQLInjectionException();
}
}
for (String dml : DML_COMMANDS) {
if (dml.equals(lowerCaseSQL)) {
throw new SQLInjectionException();
}
}
for (String comment : COMMENTS) {
if (comment.equals(lowerCaseSQL)) {
throw new SQLInjectionException();
}
}
List<String[]> commandsList = List.of(DDL_COMMANDS, DML_COMMANDS, COMMENTS);
validateSQLCommands(lowerCaseSQL, commandsList, String::equals);
// Removing the space before and after '=' operator
// String s = " \" OR 1 = 1"; For the cases like this
@@ -180,4 +142,17 @@ public final class SQLInjectionValidator {
}
}
private static void validateSQLCommand(String lowerCaseSQL, String[] commands, SQLCommandCondition condition) {
for (String command : commands) {
if (condition.checkCondition(command, lowerCaseSQL)) {
throw new SQLInjectionException();
}
}
}
private static void validateSQLCommands(String lowerCaseSQL, List<String[]> commandsList, SQLCommandCondition condition) {
for (String[] commands : commandsList) {
validateSQLCommand(lowerCaseSQL, commands, condition);
}
}
}