Contents
V5320. OWASP. Use of potentially tainted data in configuration may lead to security issues.
The analyzer has detected that unverified external data is used to configure the system or database. This may lead to security issues.
This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:
The example:
public static class DataBaseController {
private String user;
private String password;
private void connectFromRequest(HttpServletRequest request) {
String dbName = request.getParameter("db");
String dbUrl = "jdbc:mysql://localhost:3306/" + dbName +
"?useUnicode=true&characterEncoding=utf8";
Connection db = DriverManager.getConnection(dbUrl, user, password);
}
}In this example, a database connection string is generated. The dbUrl variable contains unverified data, allowing attackers to pass any database name. Similarly, they may obtain unauthorized access to data.
To harden security, developers should validate input data.
The example of a properly formed connection string:
public static class SafeDataBaseController {
private final List<String> WHITE_LIST = new ArrayList<>();
private String user;
private String password;
private void safeConnectFromRequest(HttpServletRequest request) {
String db = request.getParameter("db");
if (!WHITE_LIST.contains(db)) {
return;
}
String dbUrl = "jdbc:mysql://localhost:3306/" + db +
"?useUnicode=true&characterEncoding=utf8";
Connection db = DriverManager.getConnection(dbUrl, user, password);
}
}In this case, it is checked if the WHITE_LIST list contains the db database. This ensures that users can only access a certain set of databases, preventing unauthorized access to private information.
This diagnostic is classified as:
Was this page helpful?
