You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fineract.apache.org by "Onyx2406 (via GitHub)" <gi...@apache.org> on 2024/01/18 07:14:46 UTC
[PR] FINERACT-1782: Enhance data handling in query construction [fineract]
Onyx2406 opened a new pull request, #3690:
URL: https://github.com/apache/fineract/pull/3690
## Description
Purpose:
This pull request addresses a potential SQL injection vulnerability detected by SONAR in our data querying mechanism. The identified issue arises from the direct concatenation of user-controlled input strings into SQL queries.
Changes:
Refactored the queryDataTable method to use prepared statements.
## Checklist
Please make sure these boxes are checked before submitting your pull request - thanks!
- [x] Write the commit message as per https://github.com/apache/fineract/#pull-requests
- [x] Acknowledge that we will not review PRs that are not passing the build _("green")_ - it is your responsibility to get a proposed PR to pass the build, not primarily the project's maintainers.
- [x] Create/update unit or integration tests for verifying the changes made.
- [x] Follow coding conventions at https://cwiki.apache.org/confluence/display/FINERACT/Coding+Conventions.
- [x] Add required Swagger annotation and update API documentation at fineract-provider/src/main/resources/static/legacy-docs/apiLive.htm with details of any API changes
- [x] Submission is not a "code dump". (Large changes can be made "in repository" via a branch. Ask on the developer mailing list for guidance, if required.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-1782: Enhance data handling in query construction [fineract]
Posted by "Onyx2406 (via GitHub)" <gi...@apache.org>.
Onyx2406 commented on PR #3690:
URL: https://github.com/apache/fineract/pull/3690#issuecomment-1912018474
> Hi @Onyx2406, can you pls elaborate a bit more how this is fixing something?
>
> The original implementation is also using a preparedstatement under the hood, only Sonar doesn't detect that, hence the // NOSONAR comment, but it's perfectly safe from SQL injection.
>
> Let me know.
@galovics
Thank you for your insights and feedback on the PR. After considering your comments, I agree that the original implementation using jdbcTemplate.queryForRowSet, internally uses a PreparedStatement, is sufficient for our needs and is safe from SQL injection concerns. Given this, I am closing this PR
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] FINERACT-1782: Enhance data handling in query construction [fineract]
Posted by "Onyx2406 (via GitHub)" <gi...@apache.org>.
Onyx2406 closed pull request #3690: FINERACT-1782: Enhance data handling in query construction
URL: https://github.com/apache/fineract/pull/3690
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org