../../tomcat/conf/server.xml\", which causes the application to delete one of its own configuration files.\n\n\nString rName = request.getParameter(\"reportName\");\nFile rFile = new File(\"/usr/local/apfr/reports/\" + rName);\n...\nrFile.delete();\n\n\nExample 2: The following code uses input from a configuration file to determine which file to open and echo back to the user. If the program runs with adequate privileges and malicious users can change the configuration file, they can use the program to read any file on the system that ends with the extension
.txt.\n\n\nfis = new FileInputStream(cfg.getProperty(\"sub\")+\".txt\");\namt = fis.read(arr);\nout.println(arr);\n\n\nSome think that in the mobile world, classic vulnerabilities, such as path manipulation, do not make sense -- why would the user attack themself? However, keep in mind that the essence of mobile platforms is applications that are downloaded from various sources and run alongside each other on the same device. The likelihood of running a piece of malware next to a banking application is high, which necessitates expanding the attack surface of mobile applications to include inter-process communication.\n\nExample 3: The following code adapts
Example 1 to the Android platform.\n\n\n...\n String rName = this.getIntent().getExtras().getString(\"reportName\");\n File rFile = getBaseContext().getFileStreamPath(rName);\n...\n rFile.delete();\n...\n
doExchange().\n\n\ntry {\n doExchange();\n}\ncatch (RareException e) {\n // this can never happen\n}\n\n\nIf a RareException were to ever be thrown, the program would continue to execute as though nothing unusual had occurred. The program records no evidence indicating the special situation, potentially frustrating any later attempt to explain the program's behavior.\ntry {\n ...\n} catch (Exception e) {\n e.printStackTrace();\n}\n\n\nDepending upon the system configuration, this information can be dumped to a console, written to a log file, or exposed to a remote user. For example, with scripting mechanisms it is trivial to redirect output information from "Standard error" or "Standard output" into a file or another program. Alternatively the system that the program runs on could have a remote logging mechanism such as a "syslog" server that will send the logs to a remote device. During development you will have no way of knowing where this information may end up being displayed.\n\nIn some cases the error message tells the attacker precisely what sort of an attack the system is vulnerable to. For example, a database error message can reveal that the application is vulnerable to a SQL injection attack. Other error messages can reveal more oblique clues about the system. In Example 1, the leaked information could imply information about the type of operating system, the applications installed on the system, and the amount of care that the administrators have put into configuring the program.\n\nHere is another scenario, specific to the mobile world. Most mobile devices now implement a Near-Field Communication (NFC) protocol for quickly sharing information between devices using radio communication. It works by bringing devices to close proximity or simply having them touch each other. Even though the communication range of NFC is limited to just a few centimeters, eavesdropping, data modification and various other types of attacks are possible, since NFC alone does not ensure secure communication.\n\nExample 2: The Android platform provides support for NFC. The following code creates a message that gets pushed to the other device within the range.\n\n...\npublic static final String TAG = \"NfcActivity\";\nprivate static final String DATA_SPLITTER = \"__:DATA:__\";\nprivate static final String MIME_TYPE = \"application/my.applications.mimetype\";\n...\npublic NdefMessage createNdefMessage(NfcEvent event) {\n TelephonyManager tm = (TelephonyManager)Context.getSystemService(Context.TELEPHONY_SERVICE);\n String VERSION = tm.getDeviceSoftwareVersion();\n String text = TAG + DATA_SPLITTER + VERSION;\n NdefRecord record = new NdefRecord(NdefRecord.TNF_MIME_MEDIA,\n MIME_TYPE.getBytes(), new byte[0], text.getBytes());\n NdefRecord[] records = { record };\n NdefMessage msg = new NdefMessage(records);\n return msg;\n}\n...\n\n\nNFC Data Exchange Format (NDEF) message contains typed data, a URI, or a custom application payload. If the message contains information about the application, such as its name, MIME type, or device software version, this information could be leaked to an eavesdropper. In Example 2, Fortify Static Code Analyzer reports a System Information Leak vulnerability on the return statement.glue is not used in the following class. The author of the class has accidentally put quotes around the field name, transforming it into a string constant.\n\n\npublic class Dead {\n\n String glue;\n\n public String getGlue() {\n return \"glue\";\n }\n\n}\n\n\nExample 2: The field named glue is used in the following class, but only from a method that is never called.\n\n\npublic class Dead {\n\n String glue;\n\n private String getGlue() {\n return glue;\n }\n\n}\nr and then overwrites the value without using it.\n\n\n r = getName();\n r = getNewBuffer(buf);\n
\n...\n\tString userName = ctx.getAuthenticatedUserName();\n\tString itemName = request.getParameter(\"itemName\");\n\tString query = \"SELECT * FROM items WHERE owner = '\"\n\t\t\t\t+ userName + \"' AND itemname = '\"\n\t\t\t\t+ itemName + \"'\";\n\tResultSet rs = stmt.execute(query);\n...\n\n\nThe query intends to execute the following code:\n\n
\n\tSELECT * FROM items\n\tWHERE owner = <userName>\n\tAND itemname = <itemName>;\n\n\nHowever, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if
itemName does not contain a single-quote character. If an attacker with the user name wiley enters the string \"name' OR 'a'='a\" for itemName, then the query becomes the following:\n\n\n\tSELECT * FROM items\n\tWHERE owner = 'wiley'\n\tAND itemname = 'name' OR 'a'='a';\n\n\nThe addition of the
OR 'a'='a' condition causes the where clause to always evaluate to true, so the query becomes logically equivalent to the much simpler query:\n\n\n\tSELECT * FROM items;\n\n\nThis simplification of the query allows the attacker to bypass the requirement that the query must only return items owned by the authenticated user. The query now returns all entries stored in the
items table, regardless of their specified owner.\n\nExample 2: This example examines the effects of a different malicious value passed to the query constructed and executed in Example 1. If an attacker with the user name wiley enters the string \"name'; DELETE FROM items; --\" for itemName, then the query becomes the following two queries:\n\n\n\tSELECT * FROM items\n\tWHERE owner = 'wiley'\n\tAND itemname = 'name';\n\n\tDELETE FROM items;\n\n\t--'\n\n\nMany database servers, including Microsoft(R) SQL Server 2000, allow multiple SQL statements separated by semicolons to be executed at once. While this attack string results in an error on Oracle and other database servers that do not allow the batch-execution of statements separated by semicolons, on databases that do allow batch execution, this type of attack allows the attacker to execute arbitrary commands against the database.\n\nNotice the trailing pair of hyphens (--), which specifies to most database servers that the remainder of the statement is to be treated as a comment and not executed [4]. In this case the comment character serves to remove the trailing single-quote left over from the modified query. On a database where comments are not allowed to be used in this way, the general attack could still be made effective using a trick similar to the one used in
Example 1. If an attacker enters the string \"name'); DELETE FROM items; SELECT * FROM items WHERE 'a'='a\", the following three valid statements will be created:\n\n\n\tSELECT * FROM items\n\tWHERE owner = 'wiley'\n\tAND itemname = 'name';\n\n\tDELETE FROM items;\n\n\tSELECT * FROM items WHERE 'a'='a';\n\n\nSome think that in the mobile world, classic web application vulnerabilities, such as SQL injection, do not make sense -- why would the user attack themself? However, keep in mind that the essence of mobile platforms is applications that are downloaded from various sources and run alongside each other on the same device. The likelihood of running a piece of malware next to a banking application is high, which necessitates expanding the attack surface of mobile applications to include inter-process communication.\n\nExample 3: The following code adapts
Example 1 to the Android platform.\n\n\n...\n PasswordAuthentication pa = authenticator.getPasswordAuthentication();\n String userName = pa.getUserName();\n String itemName = this.getIntent().getExtras().getString(\"itemName\");\n String query = \"SELECT * FROM items WHERE owner = '\"\n + userName + \"' AND itemname = '\"\n + itemName + \"'\";\n SQLiteDatabase db = this.openOrCreateDatabase(\"DB\", MODE_PRIVATE, null);\n Cursor c = db.rawQuery(query, null);\n...\n\n\nOne traditional approach to preventing SQL injection attacks is to handle them as an input validation problem and either accept only characters from a whitelist of safe values or identify and escape a blacklist of potentially malicious values. Whitelisting can be a very effective means of enforcing strict input validation rules, but parameterized SQL statements require less maintenance and can offer more guarantees with respect to security. As is almost always the case, blacklisting is riddled with loopholes that make it ineffective at preventing SQL injection attacks. For example, attackers may:\n\n - Target fields that are not quoted\n - Find ways to bypass the need for certain escaped meta-characters\n - Use stored procedures to hide the injected meta-characters\n\nManually escaping characters in input to SQL queries can help, but it will not make your application secure from SQL injection attacks.\n\nAnother solution commonly proposed for dealing with SQL injection attacks is to use stored procedures. Although stored procedures prevent some types of SQL injection attacks, they fail to protect against many others. Stored procedures typically help prevent SQL injection attacks by limiting the types of statements that can be passed to their parameters. However, there are many ways around the limitations and many interesting statements that can still be passed to stored procedures. Again, stored procedures can prevent some exploits, but they will not make your application secure against SQL injection attacks.
\n<?xml version=\"1.0\"?>\n<!DOCTYPE lolz [\n <!ENTITY lol \"lol\">\n <!ENTITY lol2 \"&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;\">\n <!ENTITY lol3 \"&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;\">\n <!ENTITY lol4 \"&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;\">\n <!ENTITY lol5 \"&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;\">\n <!ENTITY lol6 \"&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;\">\n <!ENTITY lol7 \"&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;\">\n <!ENTITY lol8 \"&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;\">\n <!ENTITY lol9 \"&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;\">\n]>\n<lolz>&lol9;</lolz>\n\n\nThis test could crash the server by expanding the small XML document into more than 3GB in memory.
StringBuilder instance initialized with the default backing character array size (16) can cause the application to consume large amounts of heap memory while resizing the underlying array to fit user's data. Everytime new data is appended to a StringBuilder instance, it will try to fit it on its backing character array. If data does not fit, a new array will be created doubling the previous size while the old array will remain in the heap until it is garbage collected. This defect can be used to execute a Denial of Service (DoS) attack.\n\nExample 1: User-controlled data is appended to a StringBuilder instance initialized with the default constructor.\n\n ...\n StringBuilder sb = new StringBuilder();\n sb.append(request.getParameter(\"foo\"));\n ...\n
StringBuilder instance initialized with the default backing-array size (16). This can cause the JVM to over-consume heap memory space.StringBuilder instance initialized with the default backing-array size can cause the JVM to over-consume heap memory space.\n...\nDriverManager.getConnection(url, \"scott\", \"tiger\");\n...\n\n\nThis code will run successfully, but anyone who has access to it will have access to the password. After the program ships, there is likely no way to change the database user \"scott\" with a password of \"tiger\" unless the program is patched. An employee with access to this information can use it to break into the system. Even worse, if attackers have access to the bytecode for the application they can use the
javap -c command to access the disassembled code, which will contain the values of the passwords used. The result of this operation might look something like the following for Example 1:\n\n\njavap -c ConnMngr.class\n\n22: ldc #36; //String jdbc:mysql://ixne.com/rxsql\n24: ldc #38; //String scott\n26: ldc #17; //String tiger\n\n\nIn the mobile environment, password management is especially important given that there is such a high chance of device loss.\nExample 2: The following code uses hardcoded username and password to setup authentication for viewing protected pages with Android's WebView.\n
\n...\nwebview.setWebViewClient(new WebViewClient() {\n public void onReceivedHttpAuthRequest(WebView view,\n HttpAuthHandler handler, String host, String realm) {\n handler.proceed(\"guest\", \"allow\");\n }\n});\n...\n\n\nSimilar to Example 1, this code will run successfully, but anyone who has access to it will have access to the password.\n...\n// Default username for database connection is \"scott\"\n// Default password for database connection is \"tiger\"\n...\n\n\nThis code will run successfully, but anyone who has access to it will have access to the password. After the program ships, there is likely no way to change the database user \"scott\" with a password of \"tiger\" unless the program is patched. An employee with access to this information can use it to break into the system.
Exception can obscure exceptions that deserve special treatment or that should not be caught at this point in the program. Catching an overly broad exception essentially defeats the purpose of Java's typed exceptions, and can become particularly dangerous if the program grows and begins to throw new types of exceptions. The new exception types will not receive any attention.\n\nExample: The following code excerpt handles three types of exceptions in an identical fashion.\n\n\n try {\n doExchange();\n }\n catch (IOException e) {\n logger.error(\"doExchange failed\", e);\n }\n catch (InvocationTargetException e) {\n logger.error(\"doExchange failed\", e);\n }\n catch (SQLException e) {\n logger.error(\"doExchange failed\", e);\n }\n\n\nAt first blush, it may seem preferable to deal with these exceptions in a single catch block, as follows:\n\n\n try {\n doExchange();\n }\n catch (Exception e) {\n logger.error(\"doExchange failed\", e);\n }\n\n\nHowever, if doExchange() is modified to throw a new type of exception that should be handled in some different kind of way, the broad catch block will prevent the compiler from pointing out the situation. Further, the new catch block will now also handle exceptions derived from RuntimeException such as ClassCastException, and NullPointerException, which is not the programmer's intent.\n...\nprivate static final String encryptionKey = \"lakdsljkalkjlksdfkl\";\nbyte[] keyBytes = encryptionKey.getBytes();\nSecretKeySpec key = new SecretKeySpec(keyBytes, \"AES\");\nCipher encryptCipher = Cipher.getInstance(\"AES\");\nencryptCipher.init(Cipher.ENCRYPT_MODE, key);\n...\n\n\nAnyone with access to the code has access to the encryption key. After the application has shipped, there is no way to change the encryption key unless the program is patched. An employee with access to this information can use it to break into the system. If attackers had access to the executable for the application, they could extract the encryption key value.
false; the program could be rewritten in a simpler form. The nearby code may be present for debugging purposes, or it may not have been maintained along with the rest of the program. The expression may also be indicative of a bug earlier in the method.\n\nExample 1: The following method never sets the variable secondCall after initializing it to false. (The variable firstCall is mistakenly used twice.) The result is that the expression firstCall && secondCall will always evaluate to false, so setUpDualCall() will never be invoked.\n\n\npublic void setUpCalls() {\n boolean firstCall = false;\n boolean secondCall = false;\n\n if (fCall > 0) {\n setUpFCall();\n firstCall = true;\n }\n if (sCall > 0) {\n setUpSCall();\n firstCall = true;\n }\n\n if (firstCall && secondCall) {\n setUpDualCall();\n }\n}\n\n\nExample 2: The following method never sets the variable firstCall to true. (The variable firstCall is mistakenly set to false after the first conditional statement.) The result is that the first part of the expression firstCall && secondCall will always evaluate to false.\n\n\npublic void setUpCalls() {\n boolean firstCall = false;\n boolean secondCall = false;\n\n if (fCall > 0) {\n setUpFCall();\n firstCall = false;\n }\n if (sCall > 0) {\n setUpSCall();\n secondCall = true;\n }\n\n if (firstCall || secondCall) {\n setUpForCall();\n }\n}\nfalse.false.\n ...\n DriverManager.getConnection(url, \"scott\", \"\");\n ...\n\n\nIf the code in
Example 1 succeeds, it indicates that the database user account \"scott\" is configured with an empty password, which an attacker can easily guess. After the program ships, updating the account to use a non-empty password will require a code change.\n\nExample 2: The following code initializes a password variable to an empty string, attempts to read a stored value for the password, and compares it against a user-supplied value.\n\n\n ...\n String storedPassword = \"\";\n String temp;\n\n if ((temp = readPassword()) != null) {\n storedPassword = temp;\n }\n\n if(storedPassword.equals(userPassword))\n // Access protected resources\n ...\n }\n ...\n\n\nIf readPassword() fails to retrieve the stored password due to a database error or another problem, then an attacker could trivially bypass the password check by providing an empty string for userPassword.\n\nIn the mobile environment, password management is especially important given that there is such a high chance of device loss.\nExample 3: The following code initializes username and password variables to empty strings, reads credentials from an Android WebView store if they have not been previously rejected by the server for the current request, and uses them to setup authentication for viewing protected pages.\n\n...\nwebview.setWebViewClient(new WebViewClient() {\n public void onReceivedHttpAuthRequest(WebView view,\n HttpAuthHandler handler, String host, String realm) {\n String username = \"\";\n String password = \"\";\n\n if (handler.useHttpAuthUsernamePassword()) {\n String[] credentials = view.getHttpAuthUsernamePassword(host, realm);\n username = credentials[0];\n password = credentials[1];\n }\n handler.proceed(username, password);\n }\n});\n...\n\n\nSimilar to Example 2, if useHttpAuthUsernamePassword() returns false, an attacker will be able to view protected pages by supplying an empty password.\n (e+)+\n ([a-zA-Z]+)*\n (e|ee)+\n\nThere are no known regular expression implementations which are immune to this vulnerability. All platforms and languages are vulnerable to this attack.
\n...\nDriverManager.getConnection(url, \"scott\", \"tiger\");\n...\n\n\nThis code will run successfully, but anyone who has access to it will have access to the password. After the program ships, there is likely no way to change the database user \"scott\" with a password of \"tiger\" unless the program is patched. An employee with access to this information can use it to break into the system. Even worse, if attackers have access to the bytecode for the application they can use the
javap -c command to access the disassembled code, which will contain the values of the passwords used. The result of this operation might look something like the following for Example 1:\n\n\njavap -c ConnMngr.class\n\n22: ldc #36; //String jdbc:mysql://ixne.com/rxsql\n24: ldc #38; //String scott\n26: ldc #17; //String tiger\n\n\nIn the mobile environment, password management is especially important given that there is such a high chance of device loss.\nExample 2: The following code uses hardcoded username and password to setup authentication for viewing protected pages with Android's WebView.\n
\n...\nwebview.setWebViewClient(new WebViewClient() {\n public void onReceivedHttpAuthRequest(WebView view,\n HttpAuthHandler handler, String host, String realm) {\n handler.proceed(\"guest\", \"allow\");\n }\n});\n...\n\n\nSimilar to Example 1, this code will run successfully, but anyone who has access to it will have access to the password.this reference prior to the object being fully initialized, which can in turn lead to a vulnerability.\n\nExample 1: The following calls a method that can be overridden.\n\n\n ...\n class User {\n private String username;\n private boolean valid;\n public User(String username, String password){\n this.username = username;\n this.valid = validateUser(username, password);\n }\n public boolean validateUser(String username, String password){\n //validate user is real and can authenticate\n ...\n }\n public final boolean isValid(){\n return valid;\n }\n }\n\n\nSince the function validateUser and the class are not final, it means that they can be overridden, and then initializing a variable to the subclass that overrides this function would allow bypassing of the validateUser functionality. For example:\n\n\n ...\n class Attacker extends User{\n public Attacker(String username, String password){\n super(username, password);\n }\n public boolean validateUser(String username, String password){\n return true;\n }\n }\n ...\n class MainClass{\n public static void main(String[] args){\n User hacker = new Attacker(\"Evil\", \"Hacker\");\n if (hacker.isValid()){\n System.out.println(\"Attack successful!\");\n }else{\n System.out.println(\"Attack failed\");\n }\n }\n }\n\n\nThe code in Example 1 prints "Attack successful!", since the Attacker class overrides the validateUser() function that is called from the constructor of the superclass User, and Java will first look in the subclass for functions called from the constructor.\npublic class Totaller {\n private int total;\n public int total() {\n ...\n }\n}\n\nString remotePort = request.getParameter(\"remotePort\");\n...\nServerSocket srvr = new ServerSocket(remotePort);\nSocket skt = srvr.accept();\n...\n\n\nSome think that in the mobile world, classic web application vulnerabilities, such as resource injection, do not make sense -- why would the user attack themself? However, keep in mind that the essence of mobile platforms is applications that are downloaded from various sources and run alongside each other on the same device. The likelihood of running a piece of malware next to a banking application is high, which necessitates expanding the attack surface of mobile applications to include inter-process communication.\n\nExample 2: The following code uses a URL read from an Android intent to load the page in
WebView.\n\n\n...\n\tWebView webview = new WebView(this);\n\tsetContentView(webview);\n String url = this.getIntent().getExtras().getString(\"url\");\n\twebview.loadUrl(url);\n...\n\n\nThe kind of resource affected by user input indicates the kind of content that may be dangerous. For example, data containing special characters like period, slash, and backslash are risky when used in methods that interact with the file system. Similarly, data that contains URLs and URIs is risky for functions that create remote connections.
main() method appearing in a web application. Although this is an acceptable practice during product development, classes that are part of a production J2EE application should not define a main().\npublic class MyClass\n public static void main(String[] args) {\n System.out.println(\"hello world\");\n }\n}\n\n\nWhile most programmers go on to learn many nuances and subtleties about Java, a surprising number hang on to this first lesson and never give up on writing messages to standard output using System.out.println().\n\nThe problem is that writing directly to standard output or standard error is often used as an unstructured form of logging. Structured logging facilities provide features like logging levels, uniform formatting, a logger identifier, timestamps, and, perhaps most critically, the ability to direct the log messages to the right place. When the use of system output streams is jumbled together with the code that uses loggers properly, the result is often a well-kept log that is missing critical information.\n\nDevelopers widely accept the need for structured logging, but many continue to use system output streams in their \"pre-production\" development. If the code you are reviewing is past the initial phases of development, use of System.out or System.err may indicate an oversight in the move to a structured logging system.System.out or System.err rather than a dedicated logging facility makes it difficult to monitor the behavior of the program.Random.setSeed() should not be called with a tainted integer argument. Doing so allows an attacker to control the value used to seed the pseudorandom number generator, and therefore predict the sequence of values (usually integers) produced by calls to Random.nextInt(), Random.nextShort(), Random.nextLong(), or returned by Random.nextBoolean(), or set in Random.nextBytes(byte[]).\n null and dereferences it later. This error is often the result of a programmer initializing a variable to null when it is declared.\n\nnull when it is dereferenced at line foo to null. Later, the programmer dereferences foo before checking the object for a null value.\n\n\nFoo foo = null;\n...\nfoo.setBar(val);\n...\n}\n
\n int usrSleepTime = Integer.parseInt(usrInput);\n Thread.sleep(usrSleepTime);\n\n\nExample 2: The following code reads a String from a zip file. Because it uses the
readLine() method, it will read an unbounded amount of input. An attacker may take advantage of this code to cause an OutOfMemoryException or to consume a large amount of memory so that the program spends more time performing garbage collection or runs out of memory during some subsequent operation.\n\n\n InputStream zipInput = zipFile.getInputStream(zipEntry);\n Reader zipReader = new InputStreamReader(zipInput);\n BufferedReader br = new BufferedReader(zipReader);\n String line = br.readLine();\n
\n Statement stmt = conn.createStatement();\n ResultSet rs = stmt.executeQuery(CXN_SQL);\n harvestResults(rs);\n stmt.close();\n\nIn this case, there are program paths on which a ResultSet is not released.
read() and related methods that are part of many java.io classes. Most errors and unusual events in Java result in an exception being thrown. (This is one of the advantages that Java has over languages like C: Exceptions make it easier for programmers to think about what can go wrong.) But the stream and reader classes do not consider it unusual or exceptional if only a small amount of data becomes available. These classes simply add the small amount of data to the return buffer, and set the return value to the number of bytes or characters read. There is no guarantee that the amount of data returned is equal to the amount of data requested.\n\nThis behavior makes it important for programmers to examine the return value from read() and other IO methods to ensure that they receive the amount of data they expect.\n\nread(). If an attacker can create a smaller file, the program will recycle the remainder of the data from the previous user and handle it as though it belongs to the attacker.\n\n\nFileInputStream fis;\nbyte[] byteArray = new byte[1024];\nfor (Iterator i=users.iterator(); i.hasNext();) {\n String userName = (String) i.next();\n String pFileName = PFILE_ROOT + \"/\" + userName;\n FileInputStream fis = new FileInputStream(pFileName);\n fis.read(byteArray); // the file is always 1k bytes\n fis.close();\n processPFile(userName, byteArray);\n}\nsecure flag for each cookie. If the flag is set, the browser will only send the cookie over HTTPS. Sending cookies over an unencrypted channel can expose them to network sniffing attacks, so the secure flag helps keep a cookie's value confidential. This is especially important if the cookie contains private data or carries a session identifier.\n setSecure() is not called or is called with the value false.\n secure flag.\n\n\tCookie cookie = new Cookie(\"emailCookie\", email);\n\tresponse.addCookie(cookie);\n\n\nIf your application uses both HTTPS and HTTP but does not set the
secure flag, cookies sent during an HTTPS request will also be sent during subsequent HTTP requests. Sniffing network traffic over unencrypted wireless connections is a trivial task for attackers, so sending cookies (especially those with session IDs) over HTTP can result in application compromise.secure flag set to true.getParameter() is null before calling the member function compareTo(), potentially causing a null dereference.\n\n\nString itemName = request.getParameter(ITEM_NAME);\n\tif (itemName.compareTo(IMPORTANT_ITEM)) {\n\t\t...\n\t}\n\t...\n\n\nExample 2:. The following code shows a system property that is set to null and later dereferenced by a programmer who mistakenly assumes it will always be defined.\n\n\nSystem.clearProperty(\"os.name\");\n...\nString os = System.getProperty(\"os.name\");\nif (os.equalsIgnoreCase(\"Windows 95\") )\n\tSystem.out.println(\"Not supported\");\n\n\nThe traditional defense of this coding error is:\n\n\"I know the requested value will always exist because.... If it does not exist, the program cannot perform the desired behavior so it doesn't matter whether I handle the error or simply allow the program to die dereferencing a
null value.\"\n\nBut attackers are skilled at finding unexpected paths through programs, particularly when exceptions are involved.null.null.\n<?xml version=\"1.0\" encoding=\"ISO-8859-1\"?>\n <!DOCTYPE foo [\n <!ELEMENT foo ANY >\n <!ENTITY xxe SYSTEM \"file:///dev/random\" >]><foo>&xxe;</foo>\n\n\nThis example could crash the server (on a UNIX system), if the XML parser attempts to substitute the entity with the contents of the /dev/random file.
\n...\nDriverManager.getConnection(url, \"scott\", \"tiger\");\n...\n\n\nThis code will run successfully, but anyone who has access to it will have access to the password. After the program ships, there is likely no way to change the database user \"scott\" with a password of \"tiger\" unless the program is patched. An employee with access to this information can use it to break into the system. Even worse, if attackers have access to the bytecode for the application they can use the
javap -c command to access the disassembled code, which will contain the values of the passwords used. The result of this operation might look something like the following for Example 1:\n\n\njavap -c ConnMngr.class\n\n22: ldc #36; //String jdbc:mysql://ixne.com/rxsql\n24: ldc #38; //String scott\n26: ldc #17; //String tiger\n\n\nIn the mobile environment, password management is especially important given that there is such a high chance of device loss.\nExample 2: The following code uses hardcoded username and password to setup authentication for viewing protected pages with Android's WebView.\n
\n...\nwebview.setWebViewClient(new WebViewClient() {\n public void onReceivedHttpAuthRequest(WebView view,\n HttpAuthHandler handler, String host, String realm) {\n handler.proceed(\"guest\", \"allow\");\n }\n});\n...\n\n\nSimilar to Example 1, this code will run successfully, but anyone who has access to it will have access to the password.Exception or Throwable makes it difficult for callers to do good error handling and error recovery. Java's exception mechanism is set up to make it easy for callers to anticipate what can go wrong and write code to handle each specific exceptional circumstance. Declaring that a method throws a generic form of exception defeats this system.\n\nExample: The following method throws three types of exceptions.\n\n\npublic void doExchange()\n throws IOException, InvocationTargetException,\n SQLException {\n ...\n}\n\n\n\nWhile it might seem tidier to write\n\n\npublic void doExchange()\n throws Exception {\n ...\n}\n\n\ndoing so hampers the caller's ability to understand and handle the exceptions that occur. Further, if a later revision of doExchange() introduces a new type of exception that should be treated differently than previous exceptions, there is no easy way to enforce this requirement.USERID, FIRST_NAME\")));\n }\n\n @Ignore\n @Test","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/xxe/src/test/java/org/owasp/webgoat/xxe/SimpleXXETest.java\nStartLine: 54, EndLine: 66\nCode:\n}\n\n @Test\n public void workingAttack() throws Exception {\n //Call with XXE injection\n mockMvc.perform(MockMvcRequestBuilders.post(\"/xxe/simple\")\n .content(\" ]>\")));\n } catch (AssertionError e) {\n if (!e.getMessage().contains(completedError)) throw e;\n\n mockMvc.perform(MockMvcRequestBuilders.post(\"/SqlInjection/attack9\")\n .param(\"name\", \"Smith\")\n .param(\"auth_tan\", \"3SL99A\"))\n\n .andExpect(status().isOk())\n .andExpect(jsonPath(\"lessonCompleted\", is(true)))\n .andExpect(jsonPath(\"$.feedback\", is(SqlInjectionLesson8Test.modifySpan(messages.getMessage(\"sql-injection.9.success\")))))\n .andExpect(jsonPath(\"$.output\", containsString(\" \")));\n }\n }\n\n @Test\n public void multipleAccounts() throws Exception {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/csrf/src/test/java/org/owasp/webgoat/csrf/CSRFFeedbackTest.java\nStartLine: 66, EndLine: 79\nCode:\n@Test\n public void csrfAttack() throws Exception {\n mockMvc.perform(post(\"/csrf/feedback/message\")\n .contentType(MediaType.TEXT_PLAIN)\n .cookie(new Cookie(\"JSESSIONID\", \"test\"))\n .header(\"host\", \"localhost:8080\")\n .header(\"referer\", \"webgoat.org\")\n .content(\"{\\\"name\\\": \\\"Test\\\", \\\"email\\\": \\\"test1233@dfssdf.de\\\", \\\"subject\\\": \\\"service\\\", \\\"message\\\":\\\"dsaffd\\\"}\"))\n .andExpect(jsonPath(\"lessonCompleted\", is(true)))\n .andExpect(jsonPath(\"feedback\", StringContains.containsString(\"the flag is: \")));\n }\n}","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/test/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9Test.java\nStartLine: 74, EndLine: 102\nCode:\n}\n\n @Test\n public void multipleAccounts() throws Exception {\n try {\n mockMvc.perform(MockMvcRequestBuilders.post(\"/SqlInjection/attack9\")\n .param(\"name\", \"Smith\")\n .param(\"auth_tan\", \"3SL99A' OR '1' = '1\"))\n\n .andExpect(status().isOk())\n .andExpect(jsonPath(\"lessonCompleted\", is(false)))\n .andExpect(jsonPath(\"$.feedback\", is(SqlInjectionLesson8Test.modifySpan(messages.getMessage(\"sql-injection.9.one\")))))\n .andExpect(jsonPath(\"$.output\", containsString(\" 96134<\\\\/td> Bob<\\\\/td> Franco<\\\\/td> Marketing<\\\\/td> 83700<\\\\/td> LO9S2V<\\\\/td><\\\\/tr>\")));\n } catch (AssertionError e) {\n if (!e.getMessage().contains(completedError)) throw e;\n\n mockMvc.perform(MockMvcRequestBuilders.post(\"/SqlInjection/attack9\")\n .param(\"name\", \"Smith\")\n .param(\"auth_tan\", \"3SL99A' OR '1' = '1\"))\n\n .andExpect(status().isOk())\n .andExpect(jsonPath(\"lessonCompleted\", is(true)))\n .andExpect(jsonPath(\"$.feedback\", is(SqlInjectionLesson8Test.modifySpan(messages.getMessage(\"sql-injection.9.success\")))))\n .andExpect(jsonPath(\"$.output\", containsString(\" 96134<\\\\/td> Bob<\\\\/td> Franco<\\\\/td> Marketing<\\\\/td> 83700<\\\\/td> LO9S2V<\\\\/td><\\\\/tr>\")));\n }\n }\n\n @Test\n public void wrongNameReturnsNoAccounts() throws Exception {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/cia/src/test/java/org/owasp/webgoat/cia/CIAQuizTest.java\nStartLine: 84, EndLine: 104\nCode:\n}\n\n @Test\n public void threeAnswersWrongIsFailure() throws Exception {\n String[] solution0 = {\"Solution 1\"};\n String[] solution1 = {\"Solution 1\"};\n String[] solution2 = {\"Solution 1\"};\n String[] solution3 = {\"Solution 3\"};\n\n mockMvc.perform(MockMvcRequestBuilders.post(\"/cia/quiz\")\n .param(\"question_0_solution\", solution0)\n .param(\"question_1_solution\", solution1)\n .param(\"question_2_solution\", solution2)\n .param(\"question_3_solution\", solution3))\n\n .andExpect(status().isOk())\n .andExpect(jsonPath(\"lessonCompleted\", is(false)));\n }\n\n @Test\n public void allAnswersWrongIsFailure() throws Exception {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/http-proxies/src/test/java/org/owasp/webgoat/http_proxies/HttpBasicsInterceptRequestTest.java\nStartLine: 80, EndLine: 92\nCode:\n}\n\n @Test\n public void missingHeader() throws Exception {\n mockMvc.perform(MockMvcRequestBuilders.get(\"/HttpProxies/intercept-request\")\n .param(\"changeMe\", \"Requests are tampered easily\"))\n .andExpect(status().isOk())\n .andExpect(jsonPath(\"$.feedback\", CoreMatchers.is(messages.getMessage(\"http-proxies.intercept.failure\"))))\n .andExpect(jsonPath(\"$.lessonCompleted\", CoreMatchers.is(false)));\n }\n\n @Test\n public void whenPostAssignmentShouldNotPass() throws Exception {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTVotesEndpointTest.java\nStartLine: 175, EndLine: 185\nCode:\n}\n\n @Test\n public void guestShouldNotBeAbleToVote() throws Exception {\n mockMvc.perform(MockMvcRequestBuilders.post(\"/JWT/votings/Admin lost password\")\n .cookie(new Cookie(\"access_token\", \"\")))\n .andExpect(status().isUnauthorized());\n }\n\n @Test\n public void unknownUserWithValidTokenShouldNotBeAbleToVote() throws Exception {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/jwt/src/test/java/org/owasp/webgoat/jwt/JWTRefreshEndpointTest.java\nStartLine: 134, EndLine: 150\nCode:\n}\n\n @Test\n public void loginShouldNotWorkForJerryWithWrongPassword() throws Exception {\n ObjectMapper objectMapper = new ObjectMapper();\n\n Map finalize() method for FileInputStream eventually calls close(), but there is no guarantee as to how long it will take before the finalize() method will be invoked. In a busy environment, this can result in the JVM using up all of its file handles.\n\nprivate void processFile(String fName) throws FileNotFoundException, IOException {\n FileInputStream fis = new FileInputStream(fName);\n int sz;\n byte[] byteArray = new byte[BLOCK_SIZE];\n while ((sz = fis.read(byteArray)) != -1) {\n processBytes(byteArray, sz);\n }\n}\n\ntry {\n ...\n} catch (Exception e) {\n e.printStackTrace();\n}\n\n\nDepending upon the system configuration, this information can be dumped to a console, written to a log file, or exposed to a user. In some cases the error message tells the attacker precisely what sort of an attack the system is vulnerable to. For example, a database error message can reveal that the application is vulnerable to a SQL injection attack. Other error messages can reveal more oblique clues about the system. In Example 1, the leaked information could imply information about the type of operating system, the applications installed on the system, and the amount of care that the administrators have put into configuring the program.\n\nIn the mobile world, information leaks are also a concern.\n\nExample 2: The following code logs the stack trace of a caught exception on the Android platform.\n\n...\ntry {\n ...\n} catch (Exception e) {\n Log.e(TAG, Log.getStackTraceString(e));\n}\n...\n
\" + e.getMessage() + \"\").build());\n }\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java\nStartLine: 812, EndLine: 818\nCode:\nstatement.executeUpdate(createTable);\n } catch (SQLException e) {\n System.out.println(\"Error: unable to create ownership table: \" + e.getLocalizedMessage());\n }\n\n String inputData = \"INSERT INTO ownership VALUES (112, 101)\";","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java\nStartLine: 236, EndLine: 242\nCode:\n+ \"user_name varchar(12),\" + \"password varchar(10),\" + \"cookie varchar(30)\" + \")\";\n statement.executeUpdate(createTableStatement);\n } catch (SQLException e) {\n System.out.println(\"Error creating user admin table \" + e.getLocalizedMessage());\n }\n\n // Populate","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java\nStartLine: 972, EndLine: 978\nCode:\nstatement.executeUpdate(\"INSERT INTO Transactions VALUES (\" + data[i] + \");\");\n }\n } catch (SQLException sqle) {\n System.out.println(\"Error: Unable to insert transactions: \" + sqle.getLocalizedMessage());\n int errorCode = sqle.getErrorCode();\n System.out.println(\"Error Code: \" + errorCode);\n // ignore exceptions for Oracle and SQL Server","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java\nStartLine: 1036, EndLine: 1042\nCode:\n+ \")\";\n statement.executeUpdate(createTableStatement);\n } catch (SQLException e) {\n System.out.println(\"Error creating access_log table \" + e.getLocalizedMessage());\n }\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 69, EndLine: 75\nCode:\n}\n } catch (SQLException e) {\n System.err.println(e.getMessage());\n return trackProgress(failed().feedback(\"sql-injection.error\").output(\"
\" + e.getMessage() + \"\").build());\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 76, EndLine: 82\nCode:\nreturn checkSalaryRanking(connection, output);\n\n } catch (Exception e) {\n System.err.println(e.getMessage());\n return trackProgress(failed().feedback(\"sql-injection.error\").output(\"
\" + e.getMessage() + \"\").build());\n }\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java\nStartLine: 197, EndLine: 203\nCode:\n+ \")\";\n statement.executeUpdate(createTableStatement);\n } catch (SQLException e) {\n System.out.println(\"Error creating product table \" + e.getLocalizedMessage());\n }\n\n // Populate","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java\nStartLine: 110, EndLine: 116\nCode:\nstatement.executeUpdate(insertData1);\n statement.executeUpdate(insertData2);\n } catch (SQLException e) {\n System.out.println(\"Error creating product table \" + e.getLocalizedMessage());\n }\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java\nStartLine: 330, EndLine: 336\nCode:\n+ \"webgoat_user varchar(20)\" + \")\";\n statement.executeUpdate(createTableStatement);\n } catch (SQLException e) {\n System.out.println(\"Error creating user_login table \" + e.getLocalizedMessage());\n }\n\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-container/src/main/java/org/owasp/webgoat/session/CreateDB.java\nStartLine: 664, EndLine: 670\nCode:\nstatement.executeUpdate(createTable);\n } catch (SQLException e) {\n System.out.println(\"Error: Unable to create role table: \" + e.getLocalizedMessage());\n }\n\n String insertData1 = \"INSERT INTO roles VALUES (101, 'employee')\";","run_time":null,"start_time":"2019-10-02 23:00:39"}],"tags":{"nist":["AC-4","Rev_4"]}},{"id":"dc8326ad-41eb-4ca9-a3de-f526fd17c936","desc":"\n ...\n DriverManager.getConnection(url, \"scott\", \"\");\n ...\n
\n\nIf the code in Example 1 succeeds, it indicates that the database user account \"scott\" is configured with an empty password, which an attacker can easily guess. After the program ships, updating the account to use a non-empty password will require a code change.\n\nExample 2: The following code initializes a password variable to an empty string, attempts to read a stored value for the password, and compares it against a user-supplied value.\n\n\n ...\n String storedPassword = \"\";\n String temp;\n\n if ((temp = readPassword()) != null) {\n storedPassword = temp;\n }\n\n if(storedPassword.equals(userPassword))\n // Access protected resources\n ...\n }\n ...\n\n\nIf readPassword() fails to retrieve the stored password due to a database error or another problem, then an attacker could trivially bypass the password check by providing an empty string for userPassword.\n\nIn the mobile environment, password management is especially important given that there is such a high chance of device loss.\nExample 3: The following code initializes username and password variables to empty strings, reads credentials from an Android WebView store if they have not been previously rejected by the server for the current request, and uses them to setup authentication for viewing protected pages.\n\n...\nwebview.setWebViewClient(new WebViewClient() {\n public void onReceivedHttpAuthRequest(WebView view,\n HttpAuthHandler handler, String host, String realm) {\n String username = \"\";\n String password = \"\";\n\n if (handler.useHttpAuthUsernamePassword()) {\n String[] credentials = view.getHttpAuthUsernamePassword(host, realm);\n username = credentials[0];\n password = credentials[1];\n }\n handler.proceed(username, password);\n }\n});\n...\n\n\nSimilar to Example 2, if useHttpAuthUsernamePassword() returns false, an attacker will be able to view protected pages by supplying an empty password.\nctx = new InitialContext();\ndatasource = (DataSource)ctx.lookup(DB_DATASRC_REF);\nconn = datasource.getConnection();\n
\n\nand should avoid obtaining a connection in this way:\n\n\nconn = DriverManager.getConnection(CONNECT_STRING);\n
\n\nEvery major web application container provides pooled database connection management as part of its resource management framework. Duplicating this functionality in an application is difficult and error prone, which is part of the reason it is forbidden under the J2EE standard.make command in the /var/yp directory.\n\n\n...\nSystem.Runtime.getRuntime().exec(\"make\");\n...\n
\n\nThe problem here is that the program does not specify an absolute path for make and fails to clean its environment prior to executing the call to Runtime.exec(). If an attacker can modify the $PATH variable to point to a malicious binary called make and then execute the application in their environment, the malicious binary will be loaded instead of the one intended. Because of the nature of the application, it runs with the privileges necessary to perform system operations, which means the attacker's make will now be run with these privileges, possibly giving them complete control of the system.\n...\nDriverManager.getConnection(url, \"scott\", \"tiger\");\n...\n
\n\nThis code will run successfully, but anyone who has access to it will have access to the password. After the program ships, there is likely no way to change the database user \"scott\" with a password of \"tiger\" unless the program is patched. An employee with access to this information can use it to break into the system. Even worse, if attackers have access to the bytecode for the application they can use the javap -c command to access the disassembled code, which will contain the values of the passwords used. The result of this operation might look something like the following for Example 1:\n\n\njavap -c ConnMngr.class\n\n22: ldc #36; //String jdbc:mysql://ixne.com/rxsql\n24: ldc #38; //String scott\n26: ldc #17; //String tiger\n
\n\nIn the mobile environment, password management is especially important given that there is such a high chance of device loss.\nExample 2: The following code uses hardcoded username and password to setup authentication for viewing protected pages with Android's WebView.\n\n...\nwebview.setWebViewClient(new WebViewClient() {\n public void onReceivedHttpAuthRequest(WebView view,\n HttpAuthHandler handler, String host, String realm) {\n handler.proceed(\"guest\", \"allow\");\n }\n});\n...\n\n\nSimilar to Example 1, this code will run successfully, but anyone who has access to it will have access to the password.\n String ip = request.getRemoteAddr();\n InetAddress addr = InetAddress.getByName(ip);\n if (addr.getCanonicalHostName().endsWith(\"trustme.com\")) {\n trusted = true;\n }\n\n\nIP addresses are more reliable than DNS names, but they can also be spoofed. Attackers may easily forge the source IP address of the packets they send, but response packets will return to the forged IP address. To see the response packets, the attacker has to sniff the traffic between the victim machine and the forged IP address. In order to accomplish the required sniffing, attackers typically attempt to locate themselves on the same subnet as the victim machine. Attackers may be able to circumvent this requirement by using source routing, but source routing is disabled across much of the Internet today. In summary, IP address verification can be a useful part of an authentication scheme, but it should not be the single factor required for authentication.true; the program could be rewritten in a simpler form. The nearby code may be present for debugging purposes, or it may not have been maintained along with the rest of the program. The expression may also be indicative of a bug earlier in the method.\n\nExample 1: The following method never sets the variable secondCall after initializing it to true. (The variable firstCall is mistakenly used twice.) The result is that the expression firstCall || secondCall will always evaluate to true, so setUpForCall() will always be invoked.\n\n\npublic void setUpCalls() {\n boolean firstCall = true;\n boolean secondCall = true;\n\n if (fCall < 0) {\n cancelFCall();\n firstCall = false;\n }\n if (sCall < 0) {\n cancelSCall();\n firstCall = false;\n }\n\n if (firstCall || secondCall) {\n setUpForCall();\n }\n}\n\n\nExample 2: The following method tries to check the variables firstCall and secondCall. (The variable firstCall is mistakenly set to true instead of being checked.) The result is that the first part of the expression firstCall = true && secondCall == true will always evaluate to true.\n\n\npublic void setUpCalls() {\n boolean firstCall = false;\n boolean secondCall = false;\n\n if (fCall > 0) {\n setUpFCall();\n firstCall = true;\n }\n if (sCall > 0) {\n setUpSCall();\n secondCall = true;\n }\n\n if (firstCall = true && secondCall == true) {\n setUpDualCall();\n }\n}\ntrue.true.\n...\n\tString userName = ctx.getAuthenticatedUserName();\n\tString itemName = request.getParameter(\"itemName\");\n\tString query = \"SELECT * FROM items WHERE owner = '\"\n\t\t\t\t+ userName + \"' AND itemname = '\"\n\t\t\t\t+ itemName + \"'\";\n\tResultSet rs = stmt.execute(query);\n...\n
\n\nThe query intends to execute the following code:\n\n\n\tSELECT * FROM items\n\tWHERE owner = <userName>\n\tAND itemname = <itemName>;\n
\n\nHowever, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if itemName does not contain a single-quote character. If an attacker with the user name wiley enters the string \"name' OR 'a'='a\" for itemName, then the query becomes the following:\n\n\n\tSELECT * FROM items\n\tWHERE owner = 'wiley'\n\tAND itemname = 'name' OR 'a'='a';\n
\n\nThe addition of the OR 'a'='a' condition causes the where clause to always evaluate to true, so the query becomes logically equivalent to the much simpler query:\n\n\n\tSELECT * FROM items;\n
\n\nThis simplification of the query allows the attacker to bypass the requirement that the query must only return items owned by the authenticated user. The query now returns all entries stored in the items table, regardless of their specified owner.\n\nExample 2: This example examines the effects of a different malicious value passed to the query constructed and executed in Example 1. If an attacker with the user name wiley enters the string \"name'; DELETE FROM items; --\" for itemName, then the query becomes the following two queries:\n\n\n\tSELECT * FROM items\n\tWHERE owner = 'wiley'\n\tAND itemname = 'name';\n\n\tDELETE FROM items;\n\n\t--'\n
\n\nMany database servers, including Microsoft(R) SQL Server 2000, allow multiple SQL statements separated by semicolons to be executed at once. While this attack string results in an error on Oracle and other database servers that do not allow the batch-execution of statements separated by semicolons, on databases that do allow batch execution, this type of attack allows the attacker to execute arbitrary commands against the database.\n\nNotice the trailing pair of hyphens (--), which specifies to most database servers that the remainder of the statement is to be treated as a comment and not executed [4]. In this case the comment character serves to remove the trailing single-quote left over from the modified query. On a database where comments are not allowed to be used in this way, the general attack could still be made effective using a trick similar to the one used in Example 1. If an attacker enters the string \"name'); DELETE FROM items; SELECT * FROM items WHERE 'a'='a\", the following three valid statements will be created:\n\n\n\tSELECT * FROM items\n\tWHERE owner = 'wiley'\n\tAND itemname = 'name';\n\n\tDELETE FROM items;\n\n\tSELECT * FROM items WHERE 'a'='a';\n
\n\nSome think that in the mobile world, classic web application vulnerabilities, such as SQL injection, do not make sense -- why would the user attack themself? However, keep in mind that the essence of mobile platforms is applications that are downloaded from various sources and run alongside each other on the same device. The likelihood of running a piece of malware next to a banking application is high, which necessitates expanding the attack surface of mobile applications to include inter-process communication.\n\nExample 3: The following code adapts Example 1 to the Android platform.\n\n\n...\n PasswordAuthentication pa = authenticator.getPasswordAuthentication();\n String userName = pa.getUserName();\n String itemName = this.getIntent().getExtras().getString(\"itemName\");\n String query = \"SELECT * FROM items WHERE owner = '\"\n + userName + \"' AND itemname = '\"\n + itemName + \"'\";\n SQLiteDatabase db = this.openOrCreateDatabase(\"DB\", MODE_PRIVATE, null);\n Cursor c = db.rawQuery(query, null);\n...\n
\n\nOne traditional approach to preventing SQL injection attacks is to handle them as an input validation problem and either accept only characters from a whitelist of safe values or identify and escape a blacklist of potentially malicious values. Whitelisting can be a very effective means of enforcing strict input validation rules, but parameterized SQL statements require less maintenance and can offer more guarantees with respect to security. As is almost always the case, blacklisting is riddled with loopholes that make it ineffective at preventing SQL injection attacks. For example, attackers may:\n\n - Target fields that are not quoted\n - Find ways to bypass the need for certain escaped meta-characters\n - Use stored procedures to hide the injected meta-characters\n\nManually escaping characters in input to SQL queries can help, but it will not make your application secure from SQL injection attacks.\n\nAnother solution commonly proposed for dealing with SQL injection attacks is to use stored procedures. Although stored procedures prevent some types of SQL injection attacks, they fail to protect against many others. Stored procedures typically help prevent SQL injection attacks by limiting the types of statements that can be passed to their parameters. However, there are many ways around the limitations and many interesting statements that can still be passed to stored procedures. Again, stored procedures can prevent some exploits, but they will not make your application secure against SQL injection attacks.\n Statement stmt = conn.createStatement();\n ResultSet rs = stmt.executeQuery(CXN_SQL);\n harvestResults(rs);\n stmt.close();\n
\nIn this case, there are program paths on which a Statement is not released.
Your query was: \" + queryString.replace(\"?\", login_count)).build());\n }\n\n query.setInt(1, count);\n //String query = \"SELECT * FROM user_data WHERE Login_Count = \" + login_count + \" and userid = \" + accountName, ;\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 53, EndLine: 59\nCode:\nint count = 0;\n try {\n count = Integer.parseInt(login_count);\n } catch(Exception e) {\n return trackProgress(failed().output(\"Could not parse: \" + login_count + \" to a number\" +\n \"
Your query was: \" + queryString.replace(\"?\", login_count)).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 55, EndLine: 61\nCode:\ntry {\n count = Integer.parseInt(login_count);\n } catch(Exception e) {\n return trackProgress(failed().output(\"Could not parse: \" + login_count + \" to a number\" +\n \"
Your query was: \" + queryString.replace(\"?\", login_count)).build());\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 62, EndLine: 68\nCode:\nquery.setInt(1, count);\n //String query = \"SELECT * FROM user_data WHERE Login_Count = \" + login_count + \" and userid = \" + accountName, ;\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n ResultSet.CONCUR_READ_ONLY);\n ResultSet results = query.executeQuery();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 87, EndLine: 93\nCode:\n}\n } catch (SQLException sqle) {\n\n return trackProgress(failed().output(sqle.getMessage() + \"
Your query was: \" + queryString.replace(\"?\", login_count)).build());\n }\n } catch (Exception e) {\n return trackProgress(failed().output(this.getClass().getName() + \" : \" + e.getMessage() + \"
Your query was: \" + queryString.replace(\"?\", login_count)).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 66, EndLine: 72\nCode:\nResultSet.CONCUR_READ_ONLY);\n ResultSet results = query.executeQuery();\n\n if ((results != null) && (results.first() == true)) {\n ResultSetMetaData resultsMetaData = results.getMetaData();\n StringBuffer output = new StringBuffer();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 81, EndLine: 87\nCode:\n}\n\n } else {\n return trackProgress(failed().feedback(\"sql-injection.5b.no.results\").output(\"Your query was: \" + queryString.replace(\"?\", login_count)).build());\n\n// output.append(getLabelManager().get(\"NoResultsMatched\"));\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 74, EndLine: 80\nCode:\nresults.last();\n\n // If they get back more than one user they succeeded\n if (results.getRow() >= 6) {\n return trackProgress(success().feedback(\"sql-injection.5b.success\").output(\"Your query was: \" + queryString.replace(\"?\", login_count)).feedbackArgs(output.toString()).build());\n } else {\n return trackProgress(failed().output(output.toString() + \"
Your query was: \" + queryString.replace(\"?\", login_count)).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 75, EndLine: 81\nCode:\n// If they get back more than one user they succeeded\n if (results.getRow() >= 6) {\n return trackProgress(success().feedback(\"sql-injection.5b.success\").output(\"Your query was: \" + queryString.replace(\"?\", login_count)).feedbackArgs(output.toString()).build());\n } else {\n return trackProgress(failed().output(output.toString() + \"
Your query was: \" + queryString.replace(\"?\", login_count)).build());\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson5b.java\nStartLine: 77, EndLine: 83\nCode:\nif (results.getRow() >= 6) {\n return trackProgress(success().feedback(\"sql-injection.5b.success\").output(\"Your query was: \" + queryString.replace(\"?\", login_count)).feedbackArgs(output.toString()).build());\n } else {\n return trackProgress(failed().output(output.toString() + \"
Your query was: \" + queryString.replace(\"?\", login_count)).build());\n }\n\n } else {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionLesson6b.java\nStartLine: 53, EndLine: 59\nCode:\nString password = \"dave\";\n try {\n Connection connection = DatabaseUtilities.getConnection(getWebSession());\n String query = \"SELECT password FROM user_system_data WHERE user_name = 'dave'\";\n\n try {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionLesson6b.java\nStartLine: 57, EndLine: 63\nCode:\nString query = \"SELECT password FROM user_system_data WHERE user_name = 'dave'\";\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n ResultSet.CONCUR_READ_ONLY);\n ResultSet results = statement.executeQuery(query);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionLesson6b.java\nStartLine: 64, EndLine: 70\nCode:\nif ((results != null) && (results.first() == true)) {\n password = results.getString(\"password\");\n }\n } catch (SQLException sqle) {\n sqle.printStackTrace();\n // do nothing\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionLesson6b.java\nStartLine: 68, EndLine: 74\nCode:\nsqle.printStackTrace();\n // do nothing\n }\n } catch (Exception e) {\n e.printStackTrace();\n // do nothing\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson10.java\nStartLine: 46, EndLine: 52\nCode:\nString query = \"SELECT * FROM access_log WHERE action LIKE '%\" + action + \"%'\";\n\n try {\n Connection connection = DatabaseUtilities.getConnection(getWebSession());\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson10.java\nStartLine: 49, EndLine: 55\nCode:\nConnection connection = DatabaseUtilities.getConnection(getWebSession());\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);\n ResultSet results = statement.executeQuery(query);\n\n if (results.getStatement() != null) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson10.java\nStartLine: 65, EndLine: 71\nCode:\n}\n }\n } catch (SQLException e) {\n if (tableExists(connection)) {\n return trackProgress(failed().feedback(\"sql-injection.error\").output(\"\" + e.getMessage() + \"
\" + output.toString()).build());\n }\n else {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson10.java\nStartLine: 66, EndLine: 72\nCode:\n}\n } catch (SQLException e) {\n if (tableExists(connection)) {\n return trackProgress(failed().feedback(\"sql-injection.error\").output(\"\" + e.getMessage() + \"
\" + output.toString()).build());\n }\n else {\n return trackProgress(success().feedback(\"sql-injection.10.success\").build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson10.java\nStartLine: 69, EndLine: 75\nCode:\nreturn trackProgress(failed().feedback(\"sql-injection.error\").output(\"\" + e.getMessage() + \"
\" + output.toString()).build());\n }\n else {\n return trackProgress(success().feedback(\"sql-injection.10.success\").build());\n }\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java\nStartLine: 93, EndLine: 99\nCode:\npublic byte[] resolveSigningKeyBytes(JwsHeader header, Claims claims) {\n final String kid = (String) header.get(\"kid\");\n try {\n Connection connection = DatabaseUtilities.getConnection(webSession);\n ResultSet rs = connection.createStatement().executeQuery(\"SELECT key FROM jwt_keys WHERE id = '\" + kid + \"'\");\n while (rs.next()) {\n return TextCodec.BASE64.decode(rs.getString(1));","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java\nStartLine: 94, EndLine: 100\nCode:\nfinal String kid = (String) header.get(\"kid\");\n try {\n Connection connection = DatabaseUtilities.getConnection(webSession);\n ResultSet rs = connection.createStatement().executeQuery(\"SELECT key FROM jwt_keys WHERE id = '\" + kid + \"'\");\n while (rs.next()) {\n return TextCodec.BASE64.decode(rs.getString(1));\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java\nStartLine: 95, EndLine: 101\nCode:\ntry {\n Connection connection = DatabaseUtilities.getConnection(webSession);\n ResultSet rs = connection.createStatement().executeQuery(\"SELECT key FROM jwt_keys WHERE id = '\" + kid + \"'\");\n while (rs.next()) {\n return TextCodec.BASE64.decode(rs.getString(1));\n }\n } catch (SQLException e) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java\nStartLine: 96, EndLine: 102\nCode:\nConnection connection = DatabaseUtilities.getConnection(webSession);\n ResultSet rs = connection.createStatement().executeQuery(\"SELECT key FROM jwt_keys WHERE id = '\" + kid + \"'\");\n while (rs.next()) {\n return TextCodec.BASE64.decode(rs.getString(1));\n }\n } catch (SQLException e) {\n errorMessage[0] = e.getMessage();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/jwt/src/main/java/org/owasp/webgoat/jwt/JWTFinalEndpoint.java\nStartLine: 98, EndLine: 104\nCode:\nwhile (rs.next()) {\n return TextCodec.BASE64.decode(rs.getString(1));\n }\n } catch (SQLException e) {\n errorMessage[0] = e.getMessage();\n }\n return null;","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.java\nStartLine: 44, EndLine: 50\nCode:\nprotected AttackResult injectableQuery(String _query) {\n try {\n Connection connection = DatabaseUtilities.getConnection(getWebSession());\n String query = _query;\n\n try {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.java\nStartLine: 48, EndLine: 54\nCode:\nString query = _query;\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n ResultSet.CONCUR_READ_ONLY);\n ResultSet results = statement.executeQuery(_query);\n StringBuffer output = new StringBuffer();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.java\nStartLine: 65, EndLine: 71\nCode:\n} catch (SQLException sqle) {\n\n return trackProgress(failed().feedback(\"sql-injection.2.failed\").output(sqle.getMessage()).build());\n }\n } catch (Exception e) {\n return trackProgress(failed().output(this.getClass().getName() + \" : \" + e.getMessage()).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.java\nStartLine: 55, EndLine: 61\nCode:\nresults.first();\n\n if (results.getString(\"department\").equals(\"Marketing\")) {\n output.append(\"\" + _query + \"\");\n output.append(SqlInjectionLesson8.generateTable(results));\n return trackProgress(success().feedback(\"sql-injection.2.success\").output(output.toString()).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.java\nStartLine: 58, EndLine: 64\nCode:\nif (results.getString(\"department\").equals(\"Marketing\")) {\n output.append(\"\" + _query + \"\");\n output.append(SqlInjectionLesson8.generateTable(results));\n return trackProgress(success().feedback(\"sql-injection.2.success\").output(output.toString()).build());\n } else {\n return trackProgress(failed().feedback(\"sql-injection.2.failed\").output(output.toString()).build());\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.java\nStartLine: 60, EndLine: 66\nCode:\noutput.append(SqlInjectionLesson8.generateTable(results));\n return trackProgress(success().feedback(\"sql-injection.2.success\").output(output.toString()).build());\n } else {\n return trackProgress(failed().feedback(\"sql-injection.2.failed\").output(output.toString()).build());\n }\n\n } catch (SQLException sqle) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge5/Assignment5.java\nStartLine: 58, EndLine: 64\nCode:\ncheckDatabase(connection);\n\n if (!StringUtils.hasText(username_login) || !StringUtils.hasText(password_login)) {\n return failed().feedback(\"required4\").build();\n }\n if (!\"Larry\".equals(username_login)) {\n return failed().feedback(\"user.not.larry\").feedbackArgs(username_login).build();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge5/Assignment5.java\nStartLine: 61, EndLine: 67\nCode:\nreturn failed().feedback(\"required4\").build();\n }\n if (!\"Larry\".equals(username_login)) {\n return failed().feedback(\"user.not.larry\").feedbackArgs(username_login).build();\n }\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + USERS_TABLE_NAME + \" where userid = '\" + username_login + \"' and password = '\" + password_login + \"'\");","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 50, EndLine: 56\nCode:\nString query = \"SELECT * FROM employees WHERE last_name = '\" + name + \"' AND auth_tan = '\" + auth_tan + \"'\";\n\n try {\n Connection connection = DatabaseUtilities.getConnection(getWebSession());\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 53, EndLine: 59\nCode:\nConnection connection = DatabaseUtilities.getConnection(getWebSession());\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);\n log(connection, query);\n ResultSet results = statement.executeQuery(query);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 55, EndLine: 61\nCode:\ntry {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);\n log(connection, query);\n ResultSet results = statement.executeQuery(query);\n\n if (results.getStatement() != null) {\n if (results.first()) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 78, EndLine: 84\nCode:\nreturn trackProgress(failed().feedback(\"sql-injection.error\").build());\n }\n } catch (SQLException e) {\n return trackProgress(failed().feedback(\"sql-injection.error\").output(\"
\" + e.getMessage() + \"\").build());\n }\n\n } catch (Exception e) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 57, EndLine: 63\nCode:\nlog(connection, query);\n ResultSet results = statement.executeQuery(query);\n\n if (results.getStatement() != null) {\n if (results.first()) {\n output.append(generateTable(results));\n results.last();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 75, EndLine: 81\nCode:\nreturn trackProgress(failed().feedback(\"sql-injection.8.no.results\").build());\n }\n } else {\n return trackProgress(failed().feedback(\"sql-injection.error\").build());\n }\n } catch (SQLException e) {\n return trackProgress(failed().feedback(\"sql-injection.error\").output(\"
\" + e.getMessage() + \"\").build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 58, EndLine: 64\nCode:\nResultSet results = statement.executeQuery(query);\n\n if (results.getStatement() != null) {\n if (results.first()) {\n output.append(generateTable(results));\n results.last();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 72, EndLine: 78\nCode:\n} else {\n // no results\n return trackProgress(failed().feedback(\"sql-injection.8.no.results\").build());\n }\n } else {\n return trackProgress(failed().feedback(\"sql-injection.error\").build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 62, EndLine: 68\nCode:\noutput.append(generateTable(results));\n results.last();\n\n if (results.getRow() > 1) {\n // more than one record, the user succeeded\n return trackProgress(success().feedback(\"sql-injection.8.success\").output(output.toString()).build());\n } else {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 64, EndLine: 70\nCode:\nif (results.getRow() > 1) {\n // more than one record, the user succeeded\n return trackProgress(success().feedback(\"sql-injection.8.success\").output(output.toString()).build());\n } else {\n // only one record\n return trackProgress(failed().feedback(\"sql-injection.8.one\").output(output.toString()).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson8.java\nStartLine: 67, EndLine: 73\nCode:\nreturn trackProgress(success().feedback(\"sql-injection.8.success\").output(output.toString()).build());\n } else {\n // only one record\n return trackProgress(failed().feedback(\"sql-injection.8.one\").output(output.toString()).build());\n }\n\n } else {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 42, EndLine: 48\nCode:\n@PostMapping(\"/SqlInjectionAdvanced/challenge_Login\")\n @ResponseBody\n public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception {\n Connection connection = DatabaseUtilities.getConnection(webSession);\n SqlInjectionChallenge.checkDatabase(connection);\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + SqlInjectionChallenge.USERS_TABLE_NAME + \" where userid = ? and password = ?\");","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 43, EndLine: 49\nCode:\n@ResponseBody\n public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception {\n Connection connection = DatabaseUtilities.getConnection(webSession);\n SqlInjectionChallenge.checkDatabase(connection);\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + SqlInjectionChallenge.USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 45, EndLine: 51\nCode:\nConnection connection = DatabaseUtilities.getConnection(webSession);\n SqlInjectionChallenge.checkDatabase(connection);\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + SqlInjectionChallenge.USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);\n statement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 46, EndLine: 52\nCode:\nSqlInjectionChallenge.checkDatabase(connection);\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + SqlInjectionChallenge.USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);\n statement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 47, EndLine: 53\nCode:\nPreparedStatement statement = connection.prepareStatement(\"select password from \" + SqlInjectionChallenge.USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);\n statement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();\n\n if (resultSet.next()) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 48, EndLine: 54\nCode:\nPreparedStatement statement = connection.prepareStatement(\"select password from \" + SqlInjectionChallenge.USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);\n statement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();\n\n if (resultSet.next()) {\n return (\"tom\".equals(username_login)) ? trackProgress(success().build())","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 50, EndLine: 56\nCode:\nstatement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();\n\n if (resultSet.next()) {\n return (\"tom\".equals(username_login)) ? trackProgress(success().build())\n \t\t: success().feedback(\"ResultsButNotTom\").build();\n } else {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 51, EndLine: 57\nCode:\nResultSet resultSet = statement.executeQuery();\n\n if (resultSet.next()) {\n return (\"tom\".equals(username_login)) ? trackProgress(success().build())\n \t\t: success().feedback(\"ResultsButNotTom\").build();\n } else {\n return failed().feedback(\"NoResultsMatched\").build();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallengeLogin.java\nStartLine: 54, EndLine: 60\nCode:\nreturn (\"tom\".equals(username_login)) ? trackProgress(success().build())\n \t\t: success().feedback(\"ResultsButNotTom\").build();\n } else {\n return failed().feedback(\"NoResultsMatched\").build();\n }\n }\n}","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 73, EndLine: 79\nCode:\n@PostMapping(\"/challenge/6\")\n @ResponseBody\n public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception {\n Connection connection = DatabaseUtilities.getConnection(webSession);\n checkDatabase(connection);\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + USERS_TABLE_NAME + \" where userid = ? and password = ?\");","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 74, EndLine: 80\nCode:\n@ResponseBody\n public AttackResult login(@RequestParam String username_login, @RequestParam String password_login) throws Exception {\n Connection connection = DatabaseUtilities.getConnection(webSession);\n checkDatabase(connection);\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 76, EndLine: 82\nCode:\nConnection connection = DatabaseUtilities.getConnection(webSession);\n checkDatabase(connection);\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);\n statement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 77, EndLine: 83\nCode:\ncheckDatabase(connection);\n\n PreparedStatement statement = connection.prepareStatement(\"select password from \" + USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);\n statement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 78, EndLine: 84\nCode:\nPreparedStatement statement = connection.prepareStatement(\"select password from \" + USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);\n statement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();\n\n if (resultSet.next() && \"tom\".equals(username_login)) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 79, EndLine: 85\nCode:\nPreparedStatement statement = connection.prepareStatement(\"select password from \" + USERS_TABLE_NAME + \" where userid = ? and password = ?\");\n statement.setString(1, username_login);\n statement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();\n\n if (resultSet.next() && \"tom\".equals(username_login)) {\n return success().feedback(\"challenge.solved\").feedbackArgs(Flag.FLAGS.get(6)).build();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 81, EndLine: 87\nCode:\nstatement.setString(2, password_login);\n ResultSet resultSet = statement.executeQuery();\n\n if (resultSet.next() && \"tom\".equals(username_login)) {\n return success().feedback(\"challenge.solved\").feedbackArgs(Flag.FLAGS.get(6)).build();\n } else {\n return failed().feedback(\"challenge.close\").build();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 84, EndLine: 90\nCode:\nif (resultSet.next() && \"tom\".equals(username_login)) {\n return success().feedback(\"challenge.solved\").feedbackArgs(Flag.FLAGS.get(6)).build();\n } else {\n return failed().feedback(\"challenge.close\").build();\n }\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/challenge/src/main/java/org/owasp/webgoat/challenges/challenge6/Assignment6.java\nStartLine: 82, EndLine: 88\nCode:\nResultSet resultSet = statement.executeQuery();\n\n if (resultSet.next() && \"tom\".equals(username_login)) {\n return success().feedback(\"challenge.solved\").feedbackArgs(Flag.FLAGS.get(6)).build();\n } else {\n return failed().feedback(\"challenge.close\").build();\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/missing-function-ac/src/main/java/org/owasp/webgoat/missing_ac/Users.java\nStartLine: 48, EndLine: 54\nCode:\nprotected HashMap
Your query was: \" + query).build());\n }\n } catch (Exception e) {\n return trackProgress(failed().output(this.getClass().getName() + \" : \" + e.getMessage() + \"
Your query was: \" + query).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 52, EndLine: 58\nCode:\nString query = \"SELECT * FROM employees WHERE last_name = '\" + name + \"' AND auth_tan = '\" + auth_tan + \"'\";\n\n try {\n Connection connection = DatabaseUtilities.getConnection(getWebSession());\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 55, EndLine: 61\nCode:\nConnection connection = DatabaseUtilities.getConnection(getWebSession());\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);\n SqlInjectionLesson8.log(connection, query);\n ResultSet results = statement.executeQuery(query);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 57, EndLine: 63\nCode:\ntry {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, ResultSet.CONCUR_READ_ONLY);\n SqlInjectionLesson8.log(connection, query);\n ResultSet results = statement.executeQuery(query);\n\n if (results.getStatement() != null) {\n if (results.first()) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 70, EndLine: 76\nCode:\n}\n } catch (SQLException e) {\n System.err.println(e.getMessage());\n return trackProgress(failed().feedback(\"sql-injection.error\").output(\"
\" + e.getMessage() + \"\").build());\n }\n\n return checkSalaryRanking(connection, output);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 68, EndLine: 74\nCode:\n}\n\n }\n } catch (SQLException e) {\n System.err.println(e.getMessage());\n return trackProgress(failed().feedback(\"sql-injection.error\").output(\"
\" + e.getMessage() + \"\").build());\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 73, EndLine: 79\nCode:\nreturn trackProgress(failed().feedback(\"sql-injection.error\").output(\"
\" + e.getMessage() + \"\").build());\n }\n\n return checkSalaryRanking(connection, output);\n\n } catch (Exception e) {\n System.err.println(e.getMessage());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 59, EndLine: 65\nCode:\nSqlInjectionLesson8.log(connection, query);\n ResultSet results = statement.executeQuery(query);\n\n if (results.getStatement() != null) {\n if (results.first()) {\n output.append(SqlInjectionLesson8.generateTable(results));\n } else {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 60, EndLine: 66\nCode:\nResultSet results = statement.executeQuery(query);\n\n if (results.getStatement() != null) {\n if (results.first()) {\n output.append(SqlInjectionLesson8.generateTable(results));\n } else {\n // no results","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson9.java\nStartLine: 64, EndLine: 70\nCode:\noutput.append(SqlInjectionLesson8.generateTable(results));\n } else {\n // no results\n return trackProgress(failed().feedback(\"sql-injection.8.no.results\").build());\n }\n\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/advanced/SqlInjectionChallenge.java\nStartLine: 87, EndLine: 93\nCode:\npreparedStatement.execute();\n attackResult = success().feedback(\"user.created\").feedbackArgs(username_reg).build();\n }\n } catch(SQLException e) {\n attackResult = failed().output(\"Something went wrong\").build();\n }\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.java\nStartLine: 44, EndLine: 50\nCode:\nprotected AttackResult injectableQuery(String _query) {\n try {\n Connection connection = DatabaseUtilities.getConnection(getWebSession());\n String query = _query;\n\n try {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.java\nStartLine: 48, EndLine: 54\nCode:\nString query = _query;\n\n try {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n ResultSet.CONCUR_READ_ONLY);\n Statement check_statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n ResultSet.CONCUR_READ_ONLY);","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.java\nStartLine: 67, EndLine: 73\nCode:\n} catch (SQLException sqle) {\n\n return trackProgress(failed().output(sqle.getMessage()).build());\n }\n } catch (Exception e) {\n return trackProgress(failed().output(this.getClass().getName() + \" : \" + e.getMessage()).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.java\nStartLine: 57, EndLine: 63\nCode:\nStringBuffer output = new StringBuffer();\n // user completes lesson if the department of Tobi Barnett now is 'Sales'\n _results.first();\n if (_results.getString(\"department\").equals(\"Sales\")) {\n output.append(\"\" + _query + \"\");\n output.append(SqlInjectionLesson8.generateTable(_results));\n return trackProgress(success().output(output.toString()).build());","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.java\nStartLine: 60, EndLine: 66\nCode:\nif (_results.getString(\"department\").equals(\"Sales\")) {\n output.append(\"\" + _query + \"\");\n output.append(SqlInjectionLesson8.generateTable(_results));\n return trackProgress(success().output(output.toString()).build());\n } else {\n return trackProgress(failed().output(output.toString()).build());\n }","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.java\nStartLine: 62, EndLine: 68\nCode:\noutput.append(SqlInjectionLesson8.generateTable(_results));\n return trackProgress(success().output(output.toString()).build());\n } else {\n return trackProgress(failed().output(output.toString()).build());\n }\n\n } catch (SQLException sqle) {","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson2.java\nStartLine: 50, EndLine: 56\nCode:\ntry {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n ResultSet.CONCUR_READ_ONLY);\n ResultSet results = statement.executeQuery(_query);\n StringBuffer output = new StringBuffer();\n\n results.first();","run_time":null,"start_time":"2019-10-02 23:00:39"},{"status":"failed","code_desc":"\nPath: webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/introduction/SqlInjectionLesson3.java\nStartLine: 50, EndLine: 56\nCode:\ntry {\n Statement statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n ResultSet.CONCUR_READ_ONLY);\n Statement check_statement = connection.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE,\n ResultSet.CONCUR_READ_ONLY);\n statement.executeUpdate(_query);\n ResultSet _results = check_statement.executeQuery(\"SELECT * FROM employees WHERE last_name='Barnett';\");","run_time":null,"start_time":"2019-10-02 23:00:39"}],"tags":{"nist":["SC-5","Rev_4"]}},{"id":"1733FB59-CC13-4E99-9638-3D45FEEE9BE1","desc":"HttpOnly cookie property that prevents client-side scripts from accessing the cookie. Cross-site scripting attacks often access cookies in an attempt to steal session identifiers or authentication tokens. Without HttpOnly enabled, attackers have easier access to user cookies.\nHttpOnly parameter is not set or is set to false.\nHttpOnly property.\n\njavax.servlet.http.Cookie cookie = new javax.servlet.http.Cookie(\"emailCookie\", email);\n// Missing a call to: cookie.setHttpOnly(true);\n
HttpOnly flag to true.HttpOnly flag to true.\n...\nDriverManager.getConnection(url, \"scott\", \"tiger\");\n...\n
\n\nThis code will run successfully, but anyone who has access to it will have access to the password. After the program ships, there is likely no way to change the database user \"scott\" with a password of \"tiger\" unless the program is patched. An employee with access to this information can use it to break into the system. Even worse, if attackers have access to the bytecode for the application they can use the javap -c command to access the disassembled code, which will contain the values of the passwords used. The result of this operation might look something like the following for Example 1:\n\n\njavap -c ConnMngr.class\n\n22: ldc #36; //String jdbc:mysql://ixne.com/rxsql\n24: ldc #38; //String scott\n26: ldc #17; //String tiger\n
\n\nIn the mobile environment, password management is especially important given that there is such a high chance of device loss.\nExample 2: The following code uses hardcoded username and password to setup authentication for viewing protected pages with Android's WebView.\n\n...\nwebview.setWebViewClient(new WebViewClient() {\n public void onReceivedHttpAuthRequest(WebView view,\n HttpAuthHandler handler, String host, String realm) {\n handler.proceed(\"guest\", \"allow\");\n }\n});\n...\n\n\nSimilar to Example 1, this code will run successfully, but anyone who has access to it will have access to the password.getParameter() is null before calling the member function compareTo(), potentially causing a null dereference.\n\n\nString itemName = request.getParameter(ITEM_NAME);\n\tif (itemName.compareTo(IMPORTANT_ITEM)) {\n\t\t...\n\t}\n\t...\n\n\nExample 2:. The following code shows a system property that is set to null and later dereferenced by a programmer who mistakenly assumes it will always be defined.\n\n\nSystem.clearProperty(\"os.name\");\n...\nString os = System.getProperty(\"os.name\");\nif (os.equalsIgnoreCase(\"Windows 95\") )\n\tSystem.out.println(\"Not supported\");\n
\n\nThe traditional defense of this coding error is:\n\n\"I know the requested value will always exist because.... If it does not exist, the program cannot perform the desired behavior so it doesn't matter whether I handle the error or simply allow the program to die dereferencing a null value.\"\n\nBut attackers are skilled at finding unexpected paths through programs, particularly when exceptions are involved.null.null.<script> tag.\n\n ...\n public String tagProcessor(String tag){\n if (tag.toUpperCase().equals(\"SCRIPT\")){\n return null;\n }\n //does not contain SCRIPT tag, keep processing input\n ...\n }\n ...\n\n\nThe problem with Example 1 is that java.lang.String.toUpperCase() when used without a locale uses the rules of the default locale. Using the Turkish locale \"title\".toUpperCase() returns "T\\u0130TLE", where "\\u0130" is the "LATIN CAPITAL LETTER I WITH DOT ABOVE" character. This can lead to unexpected results, such as in Example 1 where this will prevent the word "script" from being caught by this validation, potentially leading to a Cross-Site Scripting vulnerability.\n private void writeObject(java.io.ObjectOutputStream out) throws IOException;\n private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException;\n private void readObjectNoData() throws ObjectStreamException;\n
\n\nDeviating from the method signatures that serialization requires may mean that the method is never called during serialization/deserialization, leading to incomplete serialization/deserialization, or could mean that untrusted code could gain access to the objects.\nIn the case that there are exceptions that are not thrown, it may mean that serialization/deserialization fails and crashes the application or potentially even fails quietly such that objects may be only partially constructed correctly, leading to flaws that can be extremely difficult to debug. The caller should catch these exceptions such that incorrect serialization/deserialization can be handled properly without a crash or partially constructed objects.String, it is unspecified what will happen to any data that is outside of the applicable character set. This can lead to data being lost, or a decrease in the level of security when binary data is needed to ensure proper security measures are followed.\n\nExample 1: The following code converts data into a String in order to create a hash.\n\n\n ...\n FileInputStream fis = new FileInputStream(myFile);\n byte[] byteArr = byte[BUFSIZE];\n ...\n int count = fis.read(byteArr);\n ...\n String fileString = new String(byteArr);\n String fileSHA256Hex = DigestUtils.sha256Hex(fileString);\n // use fileSHA256Hex to validate file\n ...\n
\n\nAssuming the size of the file is less than BUFSIZE, this works fine as long as the information in myFile is encoded the same as the default character set, however if it's using a different encoding, or is a binary file, it will lose information. This in turn will cause the resulting SHA hash to be less reliable, and could mean it's far easier to cause collisions, especially if any data outside of the default character set is represented by the same value, such as a question mark.String, which may lead to data loss.String may lead to data loss.doWork() can never be called.\n\n\npublic class Dead {\n private void doWork() {\n System.out.println(\"doing work\");\n }\n public static void main(String[] args) {\n System.out.println(\"running Dead\");\n }\n}\n\n\nExample 2: In the following class, two private methods call each other, but since neither one is ever invoked from anywhere else, they are both dead code.\n\n\npublic class DoubleDead {\n private void doTweedledee() {\n doTweedledumb();\n }\n private void doTweedledumb() {\n doTweedledee();\n }\n public static void main(String[] args) {\n System.out.println(\"running DoubleDead\");\n }\n}\n\n\n(In this case it is a good thing that the methods are dead: invoking either one would cause an infinite loop.)readObject() acts like a constructor, so object initialization is not complete until this function ends. Therefore when a readObject() function of a Serializable class calls an overridable function, this may provide the overriding method access to the object's state prior to it being fully initialized.\n\nExample 1: The following readObject() function calls a method that can be overridden.\n\n\n ...\n private void readObject(final ObjectInputStream ois) throws IOException, ClassNotFoundException {\n checkStream(ois);\n ois.defaultReadObject();\n }\n\n public void checkStream(ObjectInputStream stream){\n ...\n }\n\n\nSince the function checkStream() and its enclosing class are not final and public, it means that the function can be overridden, which may mean that an attacker may override the checkStream() function in order to get access to the object during deserialization.readObject() method in readObject() method within the class calls a function that may be overridden.\nString GenerateReceiptURL(String baseUrl) {\n Random ranGen = new Random();\n ranGen.setSeed((new Date()).getTime());\n return (baseUrl + ranGen.nextInt(400000000) + \".html\");\n}\n\n\nThis code uses the Random.nextInt() function to generate \"unique\" identifiers for the receipt pages it generates. Since Random.nextInt() is a statistical PRNG, it is easy for an attacker to guess the strings it generates. Although the underlying design of the receipt system is also faulty, it would be more secure if it used a random number generator that did not produce predictable receipt identifiers, such as a cryptographic PRNG.read() and related methods that are part of many java.io classes. Most errors and unusual events in Java result in an exception being thrown. (This is one of the advantages that Java has over languages like C: Exceptions make it easier for programmers to think about what can go wrong.) But the stream and reader classes do not consider it unusual or exceptional if only a small amount of data becomes available. These classes simply add the small amount of data to the return buffer, and set the return value to the number of bytes or characters read. There is no guarantee that the amount of data returned is equal to the amount of data requested.\n\nThis behavior makes it important for programmers to examine the return value from read() and other IO methods to ensure that they receive the amount of data they expect.\n\nread(). If an attacker can create a smaller file, the program will recycle the remainder of the data from the previous user and handle it as though it belongs to the attacker.\n\n\nFileInputStream fis;\nbyte[] byteArray = new byte[1024];\nfor (Iterator i=users.iterator(); i.hasNext();) {\n String userName = (String) i.next();\n String pFileName = PFILE_ROOT + \"/\" + userName;\n FileInputStream fis = new FileInputStream(pFileName);\n fis.read(byteArray); // the file is always 1k bytes\n fis.close();\n processPFile(userName, byteArray);\n}\n