CBSNexora/cbsnexora-backend
4
0
Fork 0
Code Issues Pull Requests Actions 46 Packages Projects Releases Wiki Activity

FINERACT-1893: Run reports fix

Browse Source
This commit is contained in:
Aleksandar Vidakovic
2024-01-06 18:58:38 +01:00
committed by Aleksandar Vidakovic
parent e4944c44d6
commit aec6cbe31f
1 changed files with 17 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
+17 -9
View File
@@ -38,10 +38,16 @@ public final class SQLInjectionValidator {
private static final String SQL_PATTERN = "[a-zA-Z_=,\\-:'!><.?\"`% ()0-9*\n\r]*"; private static final String SQL_PATTERN = "[a-zA-Z_=,\\-:'!><.?\"`% ()0-9*\n\r]*";
// TODO: see here https://rails-sqli.org for and
// https://larrysteinle.com/2011/02/20/use-regular-expressions-to-detect-sql-code-injection more examples
private static final List<String> INJECTION_PATTERNS = List.of("(?i).*[or|and]\s*[\"']?-1[\"']?\\s*(-*).*",
"(?i).*\\s+[\"']?(\\d+)[\"']?\\s*=\\s*[\"']?(\\1)[\"']?\\s*(-*).*");
public static void validateSQLInput(final String sqlSearch) { public static void validateSQLInput(final String sqlSearch) {
if (StringUtils.isBlank(sqlSearch)) { if (StringUtils.isBlank(sqlSearch)) {
return; return;
} }
String lowerCaseSQL = sqlSearch.toLowerCase(); String lowerCaseSQL = sqlSearch.toLowerCase();
List<String[]> commandsList = List.of(DDL_COMMANDS, DML_COMMANDS, COMMENTS); List<String[]> commandsList = List.of(DDL_COMMANDS, DML_COMMANDS, COMMENTS);
validateSQLCommands(lowerCaseSQL, commandsList, String::contains); validateSQLCommands(lowerCaseSQL, commandsList, String::contains);
@@ -53,6 +59,7 @@ public final class SQLInjectionValidator {
if (StringUtils.isBlank(sqlSearch)) { if (StringUtils.isBlank(sqlSearch)) {
return; return;
} }
String lowerCaseSQL = sqlSearch.toLowerCase().trim(); String lowerCaseSQL = sqlSearch.toLowerCase().trim();
validateSQLCommand(lowerCaseSQL, DDL_COMMANDS, String::startsWith); validateSQLCommand(lowerCaseSQL, DDL_COMMANDS, String::startsWith);
validateSQLCommand(lowerCaseSQL, COMMENTS, String::contains); validateSQLCommand(lowerCaseSQL, COMMENTS, String::contains);
@@ -80,16 +87,8 @@ public final class SQLInjectionValidator {
// Removing the space before and after '=' operator // Removing the space before and after '=' operator
// String s = " \" OR 1 = 1"; For the cases like this // String s = " \" OR 1 = 1"; For the cases like this
boolean injectionFound = false; boolean injectionFound = false;
String inputSqlString = lowerCaseSQL;
while (inputSqlString.indexOf(" =") > 0) { // Don't remove space before
// = operator
inputSqlString = inputSqlString.replaceAll(" =", "=");
}
while (inputSqlString.indexOf("= ") > 0) { // Don't remove space after = String inputSqlString = lowerCaseSQL.replaceAll("\\s*=\\s*", "=");
// operator
inputSqlString = inputSqlString.replaceAll("= ", "=");
}
StringTokenizer tokenizer = new StringTokenizer(inputSqlString, " "); StringTokenizer tokenizer = new StringTokenizer(inputSqlString, " ");
while (tokenizer.hasMoreTokens()) { while (tokenizer.hasMoreTokens()) {
@@ -131,10 +130,19 @@ public final class SQLInjectionValidator {
} }
} }
} }
if (injectionFound) { if (injectionFound) {
throw new SQLInjectionException(); throw new SQLInjectionException();
} }
for (String injectionPattern : INJECTION_PATTERNS) {
Pattern pattern = Pattern.compile(injectionPattern);
Matcher matcher = pattern.matcher(sqlSearch);
if (matcher.matches()) {
throw new SQLInjectionException();
}
}
Pattern pattern = Pattern.compile(SQL_PATTERN); Pattern pattern = Pattern.compile(SQL_PATTERN);
Matcher matcher = pattern.matcher(sqlSearch); Matcher matcher = pattern.matcher(sqlSearch);
if (!matcher.matches()) { if (!matcher.matches()) {