[jira] [Commented] (JUDDI-903) SQL Injection on JUDDI API service, delete_publisher

["ASF subversion and git services (JIRA)" <ju...@ws.apache.org>]

    [ https://issues.apache.org/jira/browse/JUDDI-903?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=14255314#comment-14255314 ] 

ASF subversion and git services commented on JUDDI-903:
-------------------------------------------------------

Commit 5fb73fd3f067b4368a1981938b21731b1da70727 in juddi's branch refs/heads/master from [~spyhunter99]
[ https://git-wip-us.apache.org/repos/asf?p=juddi.git;h=5fb73fd ]

JUDDI-903 fixed sql injection
JUDDI-902 fixed, subscriptions are now deleted
JUDDI-901 progress
JUDDI-706 finishing up most of the newer functions


> SQL Injection on JUDDI API service, delete_publisher
> ----------------------------------------------------
>
>                 Key: JUDDI-903
>                 URL: https://issues.apache.org/jira/browse/JUDDI-903
>             Project: jUDDI
>          Issue Type: Bug
>          Components: core
>    Affects Versions: 3.2, 3.2.1
>            Reporter: Alex O'Ree
>            Assignee: Alex O'Ree
>            Priority: Critical
>             Fix For: 3.3
>
>
> There's a potential for SQL injection in the Juddi API service. Due to the way the code is constructed, it's possible for a malicious user to be created containing a SQL statement as the user name. When an administrator attempts to delete the publisher, there's a chance that the malicious username may be executed as a SQL statement.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)