[
https://issues.apache.org/jira/browse/CAMEL-11625?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16127378#comment-16127378
]
Sascha Dirbach commented on CAMEL-11625:
----------------------------------------
Hi,
I had a look into this issue. The problem is, that prepared statements can only
be applied for arguments, not for the tablename. Therefore it is not really
possible to change the statements.
An approach to avoid problems at runtime could be a check, if the table name
exists or not. Code could look like this (in doStart() method):
{code:java}
boolean foundTable = false;
Connection connection = null;
DatabaseMetaData databaseMetaData = null;
ResultSet resultSet = null;
String tableName = null;
try {
connection = dataSource.getConnection();
databaseMetaData = connection.getMetaData();
resultSet = databaseMetaData.getTables(null, null, null, new String[]
{"TABLE"});
while(resultSet.next()) {
tableName = resultSet.getString("TABLE_NAME");
if(repositoryName.equalsIgnoreCase(tableName)) {
foundTable = true;
break;
}
}
} finally {
if(resultSet != null) {
resultSet.close();
}
if(connection != null) {
connection.close();
}
}
if(!foundTable) {
// Just warn or throw an exception
LOG.warn("Could not find table {}", repositoryName);
}
{code}
> Potential SQL injection in JdbcAggregationRepository
> ----------------------------------------------------
>
> Key: CAMEL-11625
> URL: https://issues.apache.org/jira/browse/CAMEL-11625
> Project: Camel
> Issue Type: Improvement
> Components: camel-sql
> Reporter: Aurélien Pupier
> Fix For: Future
>
>
> Quoting Sonar:
> "Applications that execute SQL commands should neutralize any
> externally-provided values used in those commands. Failure to do so could
> allow an attacker to include input that changes the query so that unintended
> commands are executed, or sensitive data is exposed."
> it is the case at 2 places:
> https://github.com/apache/camel/blame/master/components/camel-sql/src/main/java/org/apache/camel/processor/aggregate/jdbc/JdbcAggregationRepository.java#L288
> https://github.com/apache/camel/blame/master/components/camel-sql/src/main/java/org/apache/camel/processor/aggregate/jdbc/JdbcAggregationRepository.java#L357
> the only variable thing is the "repositoryName" so maybe there are some
> validation previously which will avoid to users to inject sql code or it is
> something that only the Camel developer can configure?
> even if it is the case, it might be a good idea to use some
> "preparedStatement" to avoid sql injection in case previous assumptions are
> no more true
> I reported here because I didn't see any "security" options on the Camel open
> source JIRA.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
