Skip to content

Veracode Batch Fix #2244

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
github-actions wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Veracode Batch Fix #2244

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
276d1f6
Veracode-Fix-Bot - update src/main/java/com/veracode/verademo/control…
invalid-email-address Feb 27, 2026
78ff43d
Veracode-Fix-Bot - update src/main/java/com/veracode/verademo/command…
invalid-email-address Feb 27, 2026
70ed293
Veracode-Fix-Bot - update src/main/java/com/veracode/verademo/command…
invalid-email-address Feb 27, 2026
7e3453f
Veracode-Fix-Bot - update src/main/java/com/veracode/verademo/control…
invalid-email-address Feb 27, 2026
1a002cb
Veracode-Fix-Bot - update src/main/java/com/veracode/verademo/command…
invalid-email-address Feb 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 12 additions & 6 deletions src/main/java/com/veracode/verademo/commands/IgnoreCommand.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,15 +36,21 @@

sqlQuery = "SELECT blab_name FROM users WHERE username = '" + blabberUsername + "'";
Statement sqlStatement = connect.createStatement();
logger.info(sqlQuery);
ResultSet result = sqlStatement.executeQuery(sqlQuery);
sqlQuery = "SELECT blab_name FROM users WHERE username = ?";
PreparedStatement sqlStatement2 = connect.prepareStatement(sqlQuery);

Check warning on line 40 in src/main/java/com/veracode/verademo/commands/IgnoreCommand.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 40**

**Issue ID:** 1010
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
logger.info(sqlQuery);
sqlStatement2.setString(1, blabberUsername);
ResultSet result = sqlStatement2.executeQuery();
result.next();

/* START BAD CODE */
String event = username + " is now ignoring " + blabberUsername + "(" + result.getString(1) + ")";
sqlQuery = "INSERT INTO users_history (blabber, event) VALUES (\"" + username + "\", \"" + event + "\")";
logger.info(sqlQuery);
sqlStatement.execute(sqlQuery);
String event = username + " is now ignoring " + blabberUsername + "(" + result.getString(1) + ")";

Check warning on line 47 in src/main/java/com/veracode/verademo/commands/IgnoreCommand.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 47**

**Issue ID:** 1005
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
sqlQuery = "INSERT INTO users_history (blabber, event) VALUES (?, ?)";
logger.info(sqlQuery);
PreparedStatement sqlStatement2 = connect.prepareStatement(sqlQuery);
sqlStatement2.setString(1, username);
sqlStatement2.setString(2, event);
sqlStatement2.execute();
/* END BAD CODE */
} catch (SQLException e) {
// TODO Auto-generated catch block
Expand Down
18 changes: 12 additions & 6 deletions src/main/java/com/veracode/verademo/commands/ListenCommand.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,15 +36,21 @@

sqlQuery = "SELECT blab_name FROM users WHERE username = '" + blabberUsername + "'";
Statement sqlStatement = connect.createStatement();
logger.info(sqlQuery);
ResultSet result = sqlStatement.executeQuery(sqlQuery);
sqlQuery = "SELECT blab_name FROM users WHERE username = ?";
PreparedStatement sqlStatement2 = connect.prepareStatement(sqlQuery);

Check warning on line 40 in src/main/java/com/veracode/verademo/commands/ListenCommand.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 40**

**Issue ID:** 1011
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
logger.info(sqlQuery);
sqlStatement2.setString(1, blabberUsername);
ResultSet result = sqlStatement2.executeQuery();
result.next();

/* START BAD CODE -----*/
String event = username + " started listening to " + blabberUsername + "(" + result.getString(1) + ")";
sqlQuery = "INSERT INTO users_history (blabber, event) VALUES (\"" + username + "\", \"" + event + "\")";
logger.info(sqlQuery);
sqlStatement.execute(sqlQuery);
String event = username + " started listening to " + blabberUsername + "(" + result.getString(1) + ")";

Check warning on line 47 in src/main/java/com/veracode/verademo/commands/ListenCommand.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 47**

**Issue ID:** 1006
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
sqlQuery = "INSERT INTO users_history (blabber, event) VALUES (?, ?)";
logger.info(sqlQuery);
PreparedStatement sqlStatement2 = connect.prepareStatement(sqlQuery);
sqlStatement2.setString(1, username);
sqlStatement2.setString(2, event);
sqlStatement2.execute();
/* END BAD CODE */
} catch (SQLException e) {
// TODO Auto-generated catch block
Expand Down
24 changes: 17 additions & 7 deletions src/main/java/com/veracode/verademo/commands/RemoveAccountCommand.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,19 +36,29 @@

sqlQuery = "SELECT blab_name FROM users WHERE username = '" + blabberUsername +"'";
Statement sqlStatement = connect.createStatement();
logger.info(sqlQuery);
ResultSet result = sqlStatement.executeQuery(sqlQuery);
sqlQuery = "SELECT blab_name FROM users WHERE username = ?";
PreparedStatement sqlStatement2 = connect.prepareStatement(sqlQuery);

Check warning on line 40 in src/main/java/com/veracode/verademo/commands/RemoveAccountCommand.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 40**

**Issue ID:** 1012
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
logger.info(sqlQuery);
sqlStatement2.setString(1, blabberUsername);
ResultSet result = sqlStatement2.executeQuery();
result.next();

/* START BAD CODE ------*/
String event = "Removed account for blabber " + result.getString(1);
sqlQuery = "INSERT INTO users_history (blabber, event) VALUES ('" + blabberUsername + "', '" + event + "')";
logger.info(sqlQuery);
sqlStatement.execute(sqlQuery);
String event = "Removed account for blabber " + result.getString(1);

Check warning on line 47 in src/main/java/com/veracode/verademo/commands/RemoveAccountCommand.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 47**

**Issue ID:** 1007
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
sqlQuery = "INSERT INTO users_history (blabber, event) VALUES (?, ?)";
logger.info(sqlQuery);
PreparedStatement sqlStatement2 = connect.prepareStatement(sqlQuery);
sqlStatement2.setString(1, blabberUsername);

Check warning on line 51 in src/main/java/com/veracode/verademo/commands/RemoveAccountCommand.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 51**

**Issue ID:** 1009
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.execute() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to execute() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
sqlStatement2.setString(2, event);
sqlStatement2.execute();

sqlQuery = "DELETE FROM users WHERE username = '" + blabberUsername + "'";
logger.info(sqlQuery);
sqlStatement.execute(sqlQuery);
sqlQuery = "DELETE FROM users WHERE username = ?";
logger.info(sqlQuery);
PreparedStatement sqlStatement2 = connect.prepareStatement(sqlQuery);
sqlStatement2.setString(1, blabberUsername);
sqlStatement2.execute();
/* END BAD CODE */

} catch (SQLException e) {
Expand Down
37 changes: 16 additions & 21 deletions src/main/java/com/veracode/verademo/controller/BlabController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -467,27 +467,22 @@ public String showBlabbers(
logger.info("User is Logged In - continuing...");

Connection connect = null;
PreparedStatement blabberQuery = null;

/* START BAD CODE */
String blabbersSql = "SELECT users.username," + " users.blab_name," + " users.created_at,"
+ " SUM(if(listeners.listener=?, 1, 0)) as listeners,"
+ " SUM(if(listeners.status='Active',1,0)) as listening"
+ " FROM users LEFT JOIN listeners ON users.username = listeners.blabber"
+ " WHERE users.username NOT IN (\"admin\",?)" + " GROUP BY users.username" + " ORDER BY " + sort + ";";

try {
logger.info("Getting Database connection");
// Get the Database Connection
Class.forName("com.mysql.jdbc.Driver");
connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());

// Find the Blabbers
logger.info(blabbersSql);
blabberQuery = connect.prepareStatement(blabbersSql);
blabberQuery.setString(1, username);
blabberQuery.setString(2, username);
ResultSet blabbersResults = blabberQuery.executeQuery();
PreparedStatement blabberQuery = null;
String blabbersSql = "SELECT users.username, " + " users.blab_name, " + " users.created_at, "
+ " SUM(if(listeners.listener=?, 1, 0)) as listeners, "
+ " SUM(if(listeners.status='Active', 1, 0)) as listening"
+ " FROM users LEFT JOIN listeners ON users.username = listeners.blabber"
+ " WHERE users.username NOT IN (\"admin\", ?)" + " GROUP BY users.username" + " ORDER BY ?;";
try {
logger.info("Getting Database connection");
Class.forName("com.mysql.jdbc.Driver");
connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());
logger.info(blabbersSql);
blabberQuery = connect.prepareStatement(blabbersSql);
blabberQuery.setString(1, username);
blabberQuery.setString(2, username);
blabberQuery.setString(3, sort);
ResultSet blabbersResults = blabberQuery.executeQuery();
/* END BAD CODE */

List<Blabber> blabbers = new ArrayList<Blabber>();
Expand Down
113 changes: 51 additions & 62 deletions src/main/java/com/veracode/verademo/controller/UserController.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -149,26 +149,22 @@
}

Connection connect = null;
Statement sqlStatement = null;

try {
// Get the Database Connection
logger.info("Creating the Database connection");
Class.forName("com.mysql.jdbc.Driver");
connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());

/* START BAD CODE */
// Execute the query
logger.info("Creating the Statement");
String sqlQuery = "select username, password, password_hint, created_at, last_login, real_name, blab_name from users where username='"
+ username + "' and password='" + md5(password) + "';";
sqlStatement = connect.createStatement();
logger.info("Execute the Statement");
ResultSet result = sqlStatement.executeQuery(sqlQuery);
PreparedStatement sqlStatement = null;
try {
logger.info("Creating the Database connection");
Class.forName("com.mysql.jdbc.Driver");
connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());
logger.info("Creating the Statement");
String sqlQuery = "select username, password, password_hint, created_at, last_login, real_name, blab_name from users where username=? and password=?";
sqlStatement = connect.prepareStatement(sqlQuery);
sqlStatement.setString(1, username);
sqlStatement.setString(2, md5(password));
logger.info("Execute the Statement");
ResultSet result = sqlStatement.executeQuery();
/* END BAD CODE */

// Did we find exactly 1 user that matched?
if (result.first()) {

Check warning on line 167 in src/main/java/com/veracode/verademo/controller/UserController.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 167**

**Issue ID:** 1013
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlQuery. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
logger.info("User Found.");
// Remember the username as a courtesy.
response.addCookie(new Cookie("username", username));
Expand Down Expand Up @@ -235,24 +231,21 @@
@ResponseBody
public String showPasswordHint(String username)
{
logger.info("Entering password-hint with username: " + username);

if (username == null || username.isEmpty()) {
return "No username provided, please type in your username first";
}

try {
Class.forName("com.mysql.jdbc.Driver");

Connection connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());

String sql = "SELECT password_hint FROM users WHERE username = '" + username + "'";
logger.info(sql);
Statement statement = connect.createStatement();
ResultSet result = statement.executeQuery(sql);
logger.info("Entering password-hint with username: " + username);
if (username == null || username.isEmpty()) {
return "No username provided, please type in your username first";
}
try {
Class.forName("com.mysql.jdbc.Driver");
Connection connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());
String sql = "SELECT password_hint FROM users WHERE username = ?";
logger.info(sql);
PreparedStatement statement = connect.prepareStatement(sql);
statement.setString(1, username);
ResultSet result = statement.executeQuery();
if (result.first()) {
String password= result.getString("password_hint");
String formatString = "Username '" + username + "' has password: %.2s%s";

Check warning on line 248 in src/main/java/com/veracode/verademo/controller/UserController.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 248**

**Issue ID:** 1015
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
logger.info(formatString);
return String.format(
formatString,
Expand Down Expand Up @@ -313,8 +306,9 @@
Connection connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());

String sql = "SELECT username FROM users WHERE username = '" + username + "'";
Statement statement = connect.createStatement();
ResultSet result = statement.executeQuery(sql);
PreparedStatement statement = connect.prepareStatement("SELECT username FROM users WHERE username = ?");
statement.setString(1, username);

Check warning on line 310 in src/main/java/com/veracode/verademo/controller/UserController.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 310**

**Issue ID:** 1014
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sql. The tainted data originated from an earlier call to AnnotationVirtualController.vc_annotation_entry.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
ResultSet result = statement.executeQuery();
if (result.first()) {
model.addAttribute("error", "Username '" + username + "' already exists!");
return "register";
Expand Down Expand Up @@ -360,29 +354,22 @@
}

Connection connect = null;
Statement sqlStatement = null;

try {
// Get the Database Connection
logger.info("Creating the Database connection");
Class.forName("com.mysql.jdbc.Driver");
connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());

/* START BAD CODE */
// Execute the query
String mysqlCurrentDateTime = (new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"))
.format(Calendar.getInstance().getTime());
StringBuilder query = new StringBuilder();
query.append("insert into users (username, password, created_at, real_name, blab_name) values(");
query.append("'" + username + "',");
query.append("'" + password + "',");
query.append("'" + mysqlCurrentDateTime + "',");
query.append("'" + realName + "',");
query.append("'" + blabName + "'");
query.append(");");

sqlStatement = connect.createStatement();
sqlStatement.execute(query.toString());
PreparedStatement sqlStatement = null;
try {
logger.info("Creating the Database connection");
Class.forName("com.mysql.jdbc.Driver");
connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());
String mysqlCurrentDateTime = (new SimpleDateFormat("yyyy-MM-dd HH:mm:ss"))
.format(Calendar.getInstance().getTime());
String query = "insert into users (username, password, created_at, real_name, blab_name) values(?, ?, ?, ?, ?)";
sqlStatement = connect.prepareStatement(query);
sqlStatement.setString(1, username);
sqlStatement.setString(2, password);
sqlStatement.setString(3, mysqlCurrentDateTime);
sqlStatement.setString(4, realName);
sqlStatement.setString(5, blabName);
sqlStatement.execute();
logger.info(query);
logger.info(query.toString());
/* END BAD CODE */

Expand Down Expand Up @@ -492,19 +479,21 @@
String sqlMyEvents = "select event from users_history where blabber=\"" + username
+ "\" ORDER BY eventid DESC; ";
logger.info(sqlMyEvents);
Statement sqlStatement = connect.createStatement();
ResultSet userHistoryResult = sqlStatement.executeQuery(sqlMyEvents);
PreparedStatement sqlStatement = connect.prepareStatement("select event from users_history where blabber=? ORDER BY eventid DESC");
sqlStatement.setString(1, username);

Check warning on line 483 in src/main/java/com/veracode/verademo/controller/UserController.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 483**

**Issue ID:** 1016
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.Statement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. The first argument to executeQuery() contains tainted data from the variable sqlMyEvents. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
ResultSet userHistoryResult = sqlStatement.executeQuery();
/* END BAD CODE */

while (userHistoryResult.next()) {
events.add(userHistoryResult.getString(1));
}

// Get the users information
String sql = "SELECT username, real_name, blab_name FROM users WHERE username = '" + username + "'";
logger.info(sql);
myInfo = connect.prepareStatement(sql);
ResultSet myInfoResults = myInfo.executeQuery();
String sql = "SELECT username, real_name, blab_name FROM users WHERE username = ?";
logger.info(sql);
myInfo = connect.prepareStatement(sql);

Check warning on line 494 in src/main/java/com/veracode/verademo/controller/UserController.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 494**

**Issue ID:** 1025
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery() was called on the myInfo object, which contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
myInfo.setString(1, username);

Check warning on line 495 in src/main/java/com/veracode/verademo/controller/UserController.java

View check run for this annotation

GitHub Actions / Veracode Fix - Scan Findings

CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Severity: 4) 

**Security finding fixed on line 495**

**Issue ID:** 1025
**CWE:** 89
**Issue Type:** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
**Severity:** 4

**Description:**
<span>This database query contains a SQL injection flaw.  The call to java.sql.PreparedStatement.executeQuery() constructs a dynamic SQL query using a variable derived from untrusted input.  An attacker could exploit this flaw to execute arbitrary SQL queries against the database. executeQuery() was called on the myInfo object, which contains tainted data. The tainted data originated from earlier calls to AnnotationVirtualController.vc_annotation_entry, and java.sql.Statement.executeQuery.</span> <span>Avoid dynamically constructing SQL queries.  Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.  Always validate untrusted input to ensure that it conforms to the expected format, using centralized data validation routines when possible.</span> <span>References: <a href="https://cwe.mitre.org/data/definitions/89.html">CWE</a> <a href="https://owasp.org/www-community/attacks/SQL_Injection">OWASP</a></span>

This finding was addressed in the applied patch.
ResultSet myInfoResults = myInfo.executeQuery();
myInfoResults.next();

// Send these values to our View
Expand Down