Veracode是一個(gè)檢測(cè)應(yīng)用程序是否存在安全漏洞的工具，更多細(xì)節(jié)請(qǐng)?jiān)L問(wèn)http://www.veracode.com
這里主要總結(jié)一下如何消除Veracode檢測(cè)結(jié)果中的SQL Injection issue(CWE ID 89)
首先，先看看VeraCode對(duì)SQL Injection Issue的定義：
SQL Injection Description
SQL injection vulnerabilities occur when data enters an application from an untrusted source and is used to dynamically
construct a SQL query. This allows an attacker to manipulate database queries in order to access, modify, or delete arbitrary data. Depending on the platform, database type, and configuration, it may also be possible to execute administrative operations on the database, access the filesystem, or execute arbitrary system commands. SQL injection attacks can also be used to subvert authentication and authorization schemes, which would enable an attacker to gain privileged access to restricted portions of the application.
再瀏覽一下VeraCode對(duì)如何解決這個(gè)問(wèn)題的建議：
Recommendations
Several techniques can be used to prevent SQL injection attacks. These techniques complement each other and address
security at different points in the application. Using multiple techniques provides defense-in-depth and minimizes the likelihood
of a SQL injection vulnerability.
Use parameterized prepared statements rather than dynamically constructing SQL queries. This will prevent the
database from interpreting the contents of bind variables as part of the query and is the most effective defense against
SQL injection.
*
Validate user-supplied input using positive filters (white lists) to ensure that it conforms to the expected format, using
centralized data validation routines when possible.
*
Normalize all user-supplied data before applying filters or regular expressions, or submitting the data to a database. This
means that all URL-encoded (%xx), HTML-encoded (&#xx;), or other encoding schemes should be reduced to the
internal character representation expected by the application. This prevents attackers from using alternate encoding
schemes to bypass filters.
*
When using database abstraction libraries such as Hibernate, do not assume that all methods exposed by the API will
automatically prevent SQL injection attacks. Most libraries contain methods that pass arbitrary queries to the database in an unsafe manner.
通過(guò)對(duì)現(xiàn)有系統(tǒng)的實(shí)踐證明，對(duì)于這類(lèi)SQL Injection Issue，消除時(shí)主要遵循以下幾個(gè)原則：
1)優(yōu)先使用PreparedSQLStatement，使用它提供的占位符來(lái)填充SQL中的參數(shù)。
2)因?yàn)镻repareSQLStatement只支持標(biāo)準(zhǔn)的SQL，對(duì)于某些數(shù)據(jù)庫(kù)廠商中中特殊的SQL語(yǔ)句，比如"init device xxxx"等就無(wú)能為力了。
這是我們可以使用java.text.MessageFormat.format(query, params)來(lái)填充SQL的參數(shù)。
1 public static String parseQuery( String query, Object[] params)
2 {
3 try
4 {
5 return MessageFormat.format(query, params);
6 }
7 catch( Exception e)
8 {
9 System.out.println(e);
10 return null;
11 }
12 }
3)Veracode會(huì)檢測(cè)傳入SQL的變量是否存在安全隱患(比如是否從文件中讀取的，或者是否從注冊(cè)表里讀取的)，這種情況需要重新定義1個(gè)變量，然后將其傳入SQL語(yǔ)句中，看如下例子
String sql = "create {0} for instance {1} on {2} = ''{3}''";
String executedSql = parseQuery(sql,
new String[]{instance.getDbName(),
instance.getName(),
instance.getDeviceName(), instance.getDeviceSize(),
}); 這里，instance是一個(gè)已經(jīng)存在的對(duì)象，如果它的變量是從文件中讀取的或者是依賴于程序外部的值，Veracode就認(rèn)為存在安全隱患，因此我們需要做如下的調(diào)整：
String dbName = FileUtil.removeControlCharacter(instance.getTempdbDbName());
String instanceName = FileUtil.removeControlCharacter(instance.getName());
String devName = FileUtil.removeControlCharacter(instance.getTempdbDeviceName());
String executedSql = parseSQLQuery(IConstants.CREATE_INSTANCE_SYS_TEMP_DB,
new String[]{dbName,instanceName,devName,deviceSize});
其中，F(xiàn)ileUtil.removeControlCharacter（）的作用是刪除String變量中的控制符，目的就是對(duì)原有的String變量進(jìn)行一次過(guò)濾后，賦值給新的變量，然后再傳給SQL語(yǔ)句。
public static final String removeControlCharacter(String input)
{
if (input == null)
{
return "";
}
StringBuilder sb = new StringBuilder();
for (int i=0; i<input.codePointCount(0, input.length()); i++)
{
int codePoint = input.codePointAt(i);
if(!Character.isISOControl(codePoint))
{
sb.appendCodePoint(codePoint);
}
}
return sb.toString();
}