<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
On 02/14/2011 09:04 AM, Greg Hellings wrote:
<blockquote
cite="mid:AANLkTi=CptLFnRss_3GbQ=aGbtTLm_VyRqhxVpjUxa8=@mail.gmail.com"
type="cite">
<p>Sounds like you are manually constructing your SQL instead of
using a prepared statement with bound variables? That should
take care of the problem.</p>
</blockquote>
<br>
If Greg is right, bound variables will help avoid SQL injection.<br>
<br>
For those not familiar with SQL injection, the concatenation of
parts into a query can lead to storage of bad stuff in the database.<br>
E.g.<br>
Take<br>
'SELECT t.data FROM my_table t WHERE t.id = "' + theId + '"';<br>
where theId is input from the outside, say a webpage.<br>
<br>
A clever user could supply the following for theId:<br>
1" OR 1=1; DELETE FROM my_table WHERE "0" = "0<br>
<br>
The resultant query would be:<br>
SELECT t.data FROM my_table t WHERE t.id = "1" OR 1=1; DELETE FROM
my_table WHERE "0" = "0"<br>
<br>
If executed, the table would have all it's contents wacked.<br>
<br>
It is also possible to replace the DELETE with an INSERT INTO,
CREATE TABLE, ..... OR anything else that the caller has privileges
for.<br>
<br>
A typical way to protect from this is to use bind variables and also
to have a separate user account with read-only privs. Another good
practice is to use JDBC to execute single statements rather than a
batch.<br>
<br>
The statement above w/ bound variables would look something like
(syntax varies between databases and jdbc):<br>
'SELECT t.data FROM my_table t WHERE t.id = :id';<br>
or maybe<br>
'SELECT t.data FROM my_table t WHERE t.id = ?'; <br>
<br>
Also, the error message represents information bleeding. It tells
the user that Firebird is the database. A hacker could then lookup
exploits for that database. It is typically a best practice to have
exception blocks that upon error give nothing informative to the
user, except that the request could not be handled at the moment.<br>
<br>
Hopefully, this is constructive.<br>
<br>
In Him,<br>
DM<br>
<br>
<blockquote
cite="mid:AANLkTi=CptLFnRss_3GbQ=aGbtTLm_VyRqhxVpjUxa8=@mail.gmail.com"
type="cite">
<p>--Greg</p>
<div class="gmail_quote">On Feb 14, 2011 7:32 AM, "Ben Morgan"
<<a moz-do-not-send="true" href="mailto:benpmorgan@gmail.com">benpmorgan@gmail.com</a>>
wrote:<br type="attribution">
> Vary the following:<br>
> <a moz-do-not-send="true"
href="http://www.crosswire.org/pages/crossnewstest.jsp?project=%27&class=2&percat=3&maxRes=6">http://www.crosswire.org/pages/crossnewstest.jsp?project='&class=2&percat=3&maxRes=6</a><br>
> <br>
> org.firebirdsql.jdbc.FBSQLException: GDS Exception.
335544569. Dynamic SQL<br>
> Error SQL error code = -104 Unexpected end of command -
line 1, column 379<br>
> <br>
> Other than that (and a number of variations on it), it
seems to work (i.e.<br>
> for validly constructed URLs it works).<br>
> <br>
> God Bless,<br>
> Ben<br>
>
-------------------------------------------------------------------------------------------<br>
> Multitudes, multitudes,<br>
> in the valley of decision!<br>
> For the day of the LORD is near<br>
> in the valley of decision.<br>
> <br>
> Giôên 3:14 (ESV)<br>
> <br>
> <br>
> <br>
> On Tue, Feb 15, 2011 at 12:23 AM, Peter von Kaehne <<a
moz-do-not-send="true" href="mailto:refdoc@gmx.net">refdoc@gmx.net</a>>
wrote:<br>
> <br>
>> I have now in a test file added the code to have a
project parametre.<br>
>><br>
>> You can see it here in action:<br>
>><br>
>><br>
>> <a moz-do-not-send="true"
href="http://www.crosswire.org/pages/crossnewstest.jsp?project=8&class=2&percat=3&maxRes=6">http://www.crosswire.org/pages/crossnewstest.jsp?project=8&class=2&percat=3&maxRes=6</a><br>
>><br>
>> Please test it and if you manage to crash it, tell me
what i did wrong. The<br>
>> underlying sql statement is pasted to the bottom of the
page underneath.<br>
>><br>
>> The idea is that you can combine news from your
particular project and news<br>
>> from e.g the "module factory", which I guess is nice to
advertise your<br>
>> particular frontend and the modules you can display
(which obviously won't<br>
>> work if your frontend has display or logic
deficiencies)<br>
>><br>
>> There are a few half or totally abandoned projects
strewn across the site<br>
>> and i will add it there to show how it would look for
them. Others can then<br>
>> see if they want to make use of the facility.<br>
>><br>
>> I will also in the next few days try and make the
production of tailored<br>
>> rss feeds similarly straight forward and then throw a
bunch of such feeds in<br>
>> a well accessible place - particularly also for
externally hosted projects<br>
>> this might be of use.<br>
>><br>
>> Peter<br>
</div>
</blockquote>
<br>
</body>
</html>