sql server - VeraCode complains SQL injection when my prepared statement has a dynamic database name - Stack Overflow

admin管理员组

文章数量:1200986

My project needs to access a SQL Server which has hundreds databases in it. All those databases have same tables structure

So I need to query those data like this:

select * 
from {0}.dbo.tableA 
where fieldA = ?

The {0} will be replaced with a dynamic database name before prepared statement is created.

Those dynamic database name comes from a server scan and users has no way to input.

VeraCode complains this code and think it has SQL injection risk.

But VeraCode didn't complain if this query has no dynamic database name. And VeraCode didn't complain if this query has no query parameter.

I also tried connection.setCatalog to avoid dynamic database name and found it is not allowed in VeraCode

I also tried to do DbName validation before replacing and still failed in VeraCode

I am confused how VeraCode decide if it has SQL injection risk.

My project needs to access a SQL Server which has hundreds databases in it. All those databases have same tables structure

So I need to query those data like this:

select * 
from {0}.dbo.tableA 
where fieldA = ?

The {0} will be replaced with a dynamic database name before prepared statement is created.

Those dynamic database name comes from a server scan and users has no way to input.

VeraCode complains this code and think it has SQL injection risk.

But VeraCode didn't complain if this query has no dynamic database name. And VeraCode didn't complain if this query has no query parameter.

I also tried connection.setCatalog to avoid dynamic database name and found it is not allowed in VeraCode

I also tried to do DbName validation before replacing and still failed in VeraCode

I am confused how VeraCode decide if it has SQL injection risk.

• sql-server
• sql-injection
• veracode

Share Improve this question Follow edited Jan 22 at 14:10 Justin asked Jan 21 at 20:19 JustinJustin 1,1201111 silver badges3131 bronze badges 8

• Veracode documentation docs.veracode.com/r/… – Bart McEndree Commented Jan 21 at 20:49
• It might be warning of scenarios similar to {0} replaced with: ValidTableName WHERE 1=2; Malicious Command Here; -- Resulting in select * from ValidTableName WHERE 1=2; Malicious Command Here; --.dbo.tableA where fieldA=? – Bart McEndree Commented Jan 21 at 20:56
• Veracode probably does not check for the source of {0} and flags any SQL statement that uses string replacement in this way. stackoverflow.com/questions/50733147/… – Bart McEndree Commented Jan 21 at 21:05
• Best advice: stackoverflow.com/questions/78027431/… – Bart McEndree Commented Jan 21 at 21:09
• Veracode has no way of knowing if a disgruntled former privileged user might have created a database named [thing; do something bad here; --] and another called [thing]]; do something bad here; --] (just to cover the [{0}] injection case). Theoretically, it might also be the case that someone exploits a vulnerability that only allows them to create an arbitrarily-named database. The SQL injection would be the missing link to gaining complete access (the needed hole in the swiss cheese model). – T N Commented Jan 22 at 4:28

 |  Show 3 more comments

1 Answer 1

Sorted by: Reset to default 1

If you have dbname validation you can ignore this issue. https://docs.veracode.com/r/Ignored_Issues

本文标签：