CODEWITHSUNDEEP
sql-injectionfortifywhitelist
shikharraje
shikharraje

Reputation: 142

Allowed approaches for addressing SQL Injection in Fortify

I have the following code for implementing a drop down menu. The user selects two values, and, based on the input, the query selects the relevant columns to be shown to the user:

String sql = "SELECT :first, :second from <table>";
sql = sql.replace(":first", <first_user_input>);
sql = sql.replace(":second", <second_user_input>);

Now, Fortify catches these lines as allowing SQL Injection. My question is, will Fortify accept a RegEx based whitelisting approach as a solution?

I was thinking of adopting the following approach:

if(isValidSQL(<first_user_input>) && isValidSQL(<second_user_input>))
{
    sql = sql.replace(...);
}
else
    throw new IllegalSQLInputException

and

public boolean isValidSQL(String param)
{
    Pattern p = Pattern.compile([[A-Z]_]+); //RegEx for matching column names like "FIRST_NAME", "LNAME" etc. but NOT "DROP<space>TABLE"
    Matcher m = p.matcher(param);
    return m.matches(param);
}

So, would Fortify accept this as a valid whitelisting method? If Fortify works on the below grammar:

valid_sql := <immutable_string_literal> //Something like "SELECT * FROM <table> WHERE x = ?" or //SELECT * FROM <table>
valid_sql := valid_sql + valid_sql //"SELECT * FROM <table>" + "WHERE x = ?"

then I don't suppose RegEx-based whitelisting would work. In that case, only this example would work, since it appends strings that are fixed at run time. I would not prefer this approach since it would result in a massive amount of switch-case statements.

Thank You

Upvotes: 1

Views: 628

Answers (1)

shikharraje
shikharraje

Reputation: 142

So, after trying the above mentioned approach, I found that Fortify is still catching the line as a potential threat. However, after reading about how Fortify works, I'm not sure if the "strictness" comes from Fortify itself, or the corporate rules defined in the XML configuration file for the same. I think that, if one's corporate rules allow regular expression-based whitelisting to work, then that should do the trick.

Upvotes: 1

Related Questions