This is an automated email from the ASF dual-hosted git repository.
adamsaghy pushed a commit to branch develop
in repository https://gitbox.apache.org/repos/asf/fineract.git
The following commit(s) were added to refs/heads/develop by this push:
new aaddb3141 FINERACT-1724: Refactoring SQLInjectionValidator
aaddb3141 is described below
commit aaddb3141cead42ef52dd6707c586a507a383f76
Author: woony-kim <[email protected]>
AuthorDate: Thu Jul 6 14:02:44 2023 +0900
FINERACT-1724: Refactoring SQLInjectionValidator
---
.../security/utils/SQLCommandCondition.java | 24 ++++++++
.../security/utils/SQLInjectionValidator.java | 65 +++++++---------------
2 files changed, 44 insertions(+), 45 deletions(-)
diff --git
a/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java
b/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java
new file mode 100644
index 000000000..4f78ddc4a
--- /dev/null
+++
b/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLCommandCondition.java
@@ -0,0 +1,24 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.fineract.infrastructure.security.utils;
+
+public interface SQLCommandCondition {
+
+ boolean checkCondition(String command, String sql);
+}
diff --git
a/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
b/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
index a89c9f16a..ec8dd9701 100644
---
a/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
+++
b/fineract-core/src/main/java/org/apache/fineract/infrastructure/security/utils/SQLInjectionValidator.java
@@ -18,6 +18,7 @@
*/
package org.apache.fineract.infrastructure.security.utils;
+import java.util.List;
import java.util.StringTokenizer;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -42,23 +43,8 @@ public final class SQLInjectionValidator {
return;
}
String lowerCaseSQL = sqlSearch.toLowerCase();
- for (String ddl : DDL_COMMANDS) {
- if (lowerCaseSQL.contains(ddl)) {
- throw new SQLInjectionException();
- }
- }
-
- for (String dml : DML_COMMANDS) {
- if (lowerCaseSQL.contains(dml)) {
- throw new SQLInjectionException();
- }
- }
-
- for (String comments : COMMENTS) {
- if (lowerCaseSQL.contains(comments)) {
- throw new SQLInjectionException();
- }
- }
+ List<String[]> commandsList = List.of(DDL_COMMANDS, DML_COMMANDS,
COMMENTS);
+ validateSQLCommands(lowerCaseSQL, commandsList, String::contains);
patternMatchSqlInjection(sqlSearch, lowerCaseSQL);
}
@@ -68,17 +54,8 @@ public final class SQLInjectionValidator {
return;
}
String lowerCaseSQL = sqlSearch.toLowerCase().trim();
- for (String ddl : DDL_COMMANDS) {
- if (lowerCaseSQL.startsWith(ddl)) {
- throw new SQLInjectionException();
- }
- }
-
- for (String comments : COMMENTS) {
- if (lowerCaseSQL.contains(comments)) {
- throw new SQLInjectionException();
- }
- }
+ validateSQLCommand(lowerCaseSQL, DDL_COMMANDS, String::startsWith);
+ validateSQLCommand(lowerCaseSQL, COMMENTS, String::contains);
// Removing the space before and after '=' operator
// String s = " \" OR 1 = 1"; For the cases like this
@@ -91,23 +68,8 @@ public final class SQLInjectionValidator {
}
String lowerCaseSQL = sqlSearch.toLowerCase();
- for (String ddl : DDL_COMMANDS) {
- if (ddl.equals(lowerCaseSQL)) {
- throw new SQLInjectionException();
- }
- }
-
- for (String dml : DML_COMMANDS) {
- if (dml.equals(lowerCaseSQL)) {
- throw new SQLInjectionException();
- }
- }
-
- for (String comment : COMMENTS) {
- if (comment.equals(lowerCaseSQL)) {
- throw new SQLInjectionException();
- }
- }
+ List<String[]> commandsList = List.of(DDL_COMMANDS, DML_COMMANDS,
COMMENTS);
+ validateSQLCommands(lowerCaseSQL, commandsList, String::equals);
// Removing the space before and after '=' operator
// String s = " \" OR 1 = 1"; For the cases like this
@@ -180,4 +142,17 @@ public final class SQLInjectionValidator {
}
}
+ private static void validateSQLCommand(String lowerCaseSQL, String[]
commands, SQLCommandCondition condition) {
+ for (String command : commands) {
+ if (condition.checkCondition(command, lowerCaseSQL)) {
+ throw new SQLInjectionException();
+ }
+ }
+ }
+
+ private static void validateSQLCommands(String lowerCaseSQL,
List<String[]> commandsList, SQLCommandCondition condition) {
+ for (String[] commands : commandsList) {
+ validateSQLCommand(lowerCaseSQL, commands, condition);
+ }
+ }
}
