c# - Checkmarx:C# 中的二阶 SQL 注入(inject)攻击

Question

我如何让静态代码分析工具(在本例中为 checkmarx)确信以下方法没有问题:

public OdbcDataReader ExecuteQuery(string sql)
{
   var cmd = new OdbcCommand(sql, connection);
   return cmd.ExecuteReader();
}

Checkmarx 告诉我以下内容:

Method ExecuteQuery gets database data from the ExecuteReader element. This element’s value then flows through the code without being properly sanitized or validated, and is eventually used in a database query in method ExecuteQuery. This may enable an Second-Order SQL Injection attack.

Answer 1

这样做令 CheckMarx 满意:

public OdbcDataReader ExecuteQuery(string sql)
{
    var cmd = new OdbcCommand(sql.Replace("'", ""), connection);
    return cmd.ExecuteReader();
}

有趣的是，我自己扫描了这个方法，使用命令并不满足:

public OdbcDataReader ExecuteQuery(string sql)
    {
        OdbcCommand cmd = connection.CreateCommand();
        cmd.CommandText = sql;
        return cmd.ExecuteReader();
    }