jamesnetherton opened a new pull request, #553:
URL: https://github.com/apache/camel-quarkus-examples/pull/553
The ETL route built its INSERT by interpolating row values into the
statement text:
```java
.simple("INSERT INTO Target (id, hotel_name, price, review)
VALUES(${body[id]}, '${body[hotel_name]}', ${body[price]}, ${body[review]})")
```
The values come from the source database rather than an end user, so this
example isn't exploitable as shipped. But it's the canonical SQL injection
shape, in the one example a reader consults for "how do I do JDBC with Camel" —
and readers will carry it into routes where the data *is* user-supplied.
It also breaks on ordinary data. A hotel name containing an apostrophe
produces `syntax error at or near ...` and the row is silently dropped.
### Changes
- **`JdbcRoutes`** — switch to `useHeadersAsParameters=true` with `:?name`
placeholders, so the values are bound as JDBC statement parameters. The
statement text is now static, so `setBody()` takes a `constant()` rather than a
Simple expression.
- **`JdbcService`** — wrap the JDBC access in try-with-resources. It
previously leaked a pooled connection per request, which would exhaust the pool
under load. The query itself is a hardcoded constant, so this is hygiene rather
than a vulnerability — but it's hygiene in a file people copy.
- **Seed data / test** — add `O'Brien's Hotel` as a regression test. It
fails on the old route and passes on the new one.
### Verification
Seeding the source database with hostile values and running the route:
| Source value | Before | After |
|---|---|---|
| `O'Brien's Hotel` | `syntax error at or near "Brien"`, row silently
dropped | stored correctly |
| `X', 0, 0); CREATE TABLE pwned AS SELECT 1 AS owned; --` | `pwned` table
created in `target_db` | stored verbatim as data |
Postgres allows multiple statements in a single `Statement.execute`, and
`JdbcProducer` uses a plain `Statement` unless `useHeadersAsParameters` is set
— so the second row really did execute attacker-chosen DDL against the target
database before this change.
`mvn clean install` passes for the module, including the formatter,
import-order and license header checks. The native build has not been run
locally.
_Claude Code on behalf of James Netherton_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
