FINERACT-1871: Run reports fix for 1.7.x
diff --git a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
index a8128a4..4a5d3b2 100644
--- a/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
+++ b/fineract-provider/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
@@ -18,6 +18,7 @@
*/
package org.apache.fineract.infrastructure.security.utils;
+import java.util.List;
import java.util.StringTokenizer;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -37,10 +38,15 @@
private static final String SQL_PATTERN = "[a-zA-Z_=,\\-'!><.?\"`% ()0-9*\n\r]*";
+ // https://larrysteinle.com/2011/02/20/use-regular-expressions-to-detect-sql-code-injection more examples
+ private static final List<String> INJECTION_PATTERNS = List.of("(?i).*[or|and]\s*[\"']?-1[\"']?\\s*(-*).*",
+ "(?i).*\\s+[\"']?(\\d+)[\"']?\\s*=\\s*[\"']?(\\1)[\"']?\\s*(-*).*");
+
public static void validateSQLInput(final String sqlSearch) {
if (StringUtils.isBlank(sqlSearch)) {
return;
}
+
String lowerCaseSQL = sqlSearch.toLowerCase();
for (String ddl : DDL_COMMANDS) {
if (lowerCaseSQL.contains(ddl)) {
@@ -63,16 +69,8 @@
// Removing the space before and after '=' operator
// String s = " \" OR 1 = 1"; For the cases like this
boolean injectionFound = false;
- String inputSqlString = lowerCaseSQL;
- while (inputSqlString.indexOf(" =") > 0) { // Don't remove space before
- // = operator
- inputSqlString = inputSqlString.replaceAll(" =", "=");
- }
- while (inputSqlString.indexOf("= ") > 0) { // Don't remove space after =
- // operator
- inputSqlString = inputSqlString.replaceAll("= ", "=");
- }
+ String inputSqlString = lowerCaseSQL.replaceAll("\\s*=\\s*", "=");
StringTokenizer tokenizer = new StringTokenizer(inputSqlString, " ");
while (tokenizer.hasMoreTokens()) {
@@ -118,6 +116,14 @@
throw new SQLInjectionException();
}
+ for (String injectionPattern : INJECTION_PATTERNS) {
+ Pattern pattern = Pattern.compile(injectionPattern);
+ Matcher matcher = pattern.matcher(sqlSearch);
+ if (matcher.matches()) {
+ throw new SQLInjectionException();
+ }
+ }
+
Pattern pattern = Pattern.compile(SQL_PATTERN);
Matcher matcher = pattern.matcher(sqlSearch);
if (!matcher.matches()) {
@@ -145,16 +151,8 @@
// Removing the space before and after '=' operator
// String s = " \" OR 1 = 1"; For the cases like this
boolean injectionFound = false;
- String inputSqlString = lowerCaseSQL;
- while (inputSqlString.indexOf(" =") > 0) { // Don't remove space before
- // = operator
- inputSqlString = inputSqlString.replaceAll(" =", "=");
- }
- while (inputSqlString.indexOf("= ") > 0) { // Don't remove space after =
- // operator
- inputSqlString = inputSqlString.replaceAll("= ", "=");
- }
+ String inputSqlString = lowerCaseSQL.replaceAll("\\s*=\\s*", "=");
StringTokenizer tokenizer = new StringTokenizer(inputSqlString, " ");
while (tokenizer.hasMoreTokens()) {
@@ -200,6 +198,14 @@
throw new SQLInjectionException();
}
+ for (String injectionPattern : INJECTION_PATTERNS) {
+ Pattern pattern = Pattern.compile(injectionPattern);
+ Matcher matcher = pattern.matcher(sqlSearch);
+ if (matcher.matches()) {
+ throw new SQLInjectionException();
+ }
+ }
+
Pattern pattern = Pattern.compile(SQL_PATTERN);
Matcher matcher = pattern.matcher(sqlSearch);
if (!matcher.matches()) {
