hibernate - 如何修复 SQL 注入验证码问题 - CWE 564

Question

@Override
public AssetLibraryReference selectALRefByName(String entityName,String name) throws Exception {
    AssetLibraryReference returnRef = null;
    String query = "from " + entityName + " where name = :name ";
    
    try {
        returnRef = sessionQueryUtil.doSessionQuery(session -> {
        //  queryStr.append("from " + entityName + " where name = :name ");             
            
          Query q =  session.createQuery(query);
                  q.setString("name", name);    
            
            
            return (AssetLibraryReference)q.uniqueResult();
        });
    } catch (HibernateException e) {
        LOG.error ("Caught hibernate exception",e);
        e.printStackTrace();
        throw e;
    } catch (Exception e) {
        LOG.error("Caught Exception :"+e.getMessage());
        e.printStackTrace();
        throw e;
    }

    return returnRef;
}

我收到验证码扫描错误Query q = session.createQuery(query);。谁能帮我解决这个问题。我可以在这里使用什么来解决问题。验证码问题 ID 是 CWE 564。

标签： hibernateveracodesecure-coding

Answer 1

改用 query.setParameter 来使 name 成为防止 SQL 注入的命名参数

@Override
public AssetLibraryReference selectALRefByName(String entityName,String name) throws Exception {
    AssetLibraryReference returnRef = null;
    String query = "from " + entityName + " where name = :name ";
    
    try {
        returnRef = sessionQueryUtil.doSessionQuery(session -> {
        //  queryStr.append("from " + entityName + " where name = :name ");             
            
          Query q =  session.createQuery(query);
                  q.setParameter("name", name);    
            
            
            return (AssetLibraryReference)q.uniqueResult();
        });
    } catch (HibernateException e) {
        LOG.error ("Caught hibernate exception",e);
        e.printStackTrace();
        throw e;
    } catch (Exception e) {
        LOG.error("Caught Exception :"+e.getMessage());
        e.printStackTrace();
        throw e;
    }

    return returnRef;
}