FINERACT-1724: Refactoring SQLInjectionValidator

fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java

@@ -0,0 +1,24 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.utils;
+
+public interface SQLCommandCondition {
+
+    boolean checkCondition(String command, String sql);
+}

fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java

@@ -18,6 +18,7 @@
  */
 package org.apache.fineract.infrastructure.security.utils;
 
+import java.util.List;
 import java.util.StringTokenizer;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
@@ -42,23 +43,8 @@ public final class SQLInjectionValidator {
             return;
         }
         String lowerCaseSQL = sqlSearch.toLowerCase();
-        for (String ddl : DDL_COMMANDS) {
+        List<String[]> commandsList = List.of(DDL_COMMANDS, DML_COMMANDS, COMMENTS);
-            if (lowerCaseSQL.contains(ddl)) {
+        validateSQLCommands(lowerCaseSQL, commandsList, String::contains);
-                throw new SQLInjectionException();
-            }
-        }
-
-        for (String dml : DML_COMMANDS) {
-            if (lowerCaseSQL.contains(dml)) {
-                throw new SQLInjectionException();
-            }
-        }
-
-        for (String comments : COMMENTS) {
-            if (lowerCaseSQL.contains(comments)) {
-                throw new SQLInjectionException();
-            }
-        }
 
         patternMatchSqlInjection(sqlSearch, lowerCaseSQL);
     }
@@ -68,17 +54,8 @@ public final class SQLInjectionValidator {
             return;
         }
         String lowerCaseSQL = sqlSearch.toLowerCase().trim();
-        for (String ddl : DDL_COMMANDS) {
+        validateSQLCommand(lowerCaseSQL, DDL_COMMANDS, String::startsWith);
-            if (lowerCaseSQL.startsWith(ddl)) {
+        validateSQLCommand(lowerCaseSQL, COMMENTS, String::contains);
-                throw new SQLInjectionException();
-            }
-        }
-
-        for (String comments : COMMENTS) {
-            if (lowerCaseSQL.contains(comments)) {
-                throw new SQLInjectionException();
-            }
-        }
 
         // Removing the space before and after '=' operator
         // String s = " \" OR 1 = 1"; For the cases like this
@@ -91,23 +68,8 @@ public final class SQLInjectionValidator {
         }
 
         String lowerCaseSQL = sqlSearch.toLowerCase();
-        for (String ddl : DDL_COMMANDS) {
+        List<String[]> commandsList = List.of(DDL_COMMANDS, DML_COMMANDS, COMMENTS);
-            if (ddl.equals(lowerCaseSQL)) {
+        validateSQLCommands(lowerCaseSQL, commandsList, String::equals);
-                throw new SQLInjectionException();
-            }
-        }
-
-        for (String dml : DML_COMMANDS) {
-            if (dml.equals(lowerCaseSQL)) {
-                throw new SQLInjectionException();
-            }
-        }
-
-        for (String comment : COMMENTS) {
-            if (comment.equals(lowerCaseSQL)) {
-                throw new SQLInjectionException();
-            }
-        }
 
         // Removing the space before and after '=' operator
         // String s = " \" OR 1 = 1"; For the cases like this
@@ -180,4 +142,17 @@ public final class SQLInjectionValidator {
         }
     }
 
+    private static void validateSQLCommand(String lowerCaseSQL, String[] commands, SQLCommandCondition condition) {
+        for (String command : commands) {
+            if (condition.checkCondition(command, lowerCaseSQL)) {
+                throw new SQLInjectionException();
+            }
+        }
+    }
+
+    private static void validateSQLCommands(String lowerCaseSQL, List<String[]> commandsList, SQLCommandCondition condition) {
+        for (String[] commands : commandsList) {
+            validateSQLCommand(lowerCaseSQL, commands, condition);
+        }
+    }
 }