java - Java中的SQL注入(inject)攻击

Question

我正在尝试使用java代码实现其中一个场景。我正在编写一些糟糕的代码来通过 sonarqube 对其进行分析。

我尝试测试 https://rules.sonarsource.com/java/tag/SonarSecurity/RSPEC-3649 中的“SQL 查询不应容易受到注入(inject)攻击” 。下面是我试图分析的代码，

package group;
import java.util.*;
import java.io.PrintStream;
import java.nio.file.*;
import javax.naming.directory.*;
import javax.naming.ldap.*;
import javax.naming.*;

public class SonarDemo {

    public static void main(String[] args) {
        PrintStream o = System.out; //NOSONAR

        String pass = args[0];//request.getParameter("pass");
        String user = args[1];
        String query = "SELECT * FROM users WHERE user = '" + user + "' AND pass = '" + pass + "'"; // Unsafe
        Properties connectionProps = new Properties();
        connectionProps.put("user", user);
        connectionProps.put("password", pass);
        java.sql.Connection connection = null;
        try {
            connection = java.sql.DriverManager.getConnection("jdbc:localhost:sql1;create=true",connectionProps);
            java.sql.Statement statement = connection.createStatement();
            java.sql.ResultSet resultSet = statement.executeQuery(query);
            Files.exists(Paths.get("/home/", user));

            String filter = "(&(uid=" + user + ")(userPassword=" + pass + "))"; // Unsafe

            LdapContext ctx = new InitialLdapContext();
            NamingEnumeration<SearchResult> results = ctx.search("ou=system", filter, new SearchControls());

        } catch (Exception e){
            o.println("Exception");
        }

    }

}

但是代码中存在一些问题，sonarqube 无法获取此代码并显示注入(inject)攻击存在问题。

如何修改此代码以创建一些 SQL 注入(inject)攻击，以便我的 sonarqube 能够在仪表板上显示此错误？

简而言之，修改上面的代码以创建注入(inject)攻击，如此处所述 https://rules.sonarsource.com/java/tag/SonarSecurity/RSPEC-3649

Answer 1

User provided data such as URL parameters should always be considered as untrusted and tainted.

据我所知，运行时参数不会被识别为来自用户的输入。要重现该问题，请尝试从请求的 URL 参数中获取 user 和 pass。

public boolean authenticate(javax.servlet.http.HttpServletRequest request, java.sql.Connection connection) throws SQLException {
  String user = request.getParameter("user");
  String pass = request.getParameter("pass");
}