Mailing-List: contact issues-help@camel.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@camel.apache.org
Date: Thu, 3 Aug 2017 07:07:02 +0000 (UTC)
From: "Claus Ibsen (JIRA)" <jira@apache.org>
To: issues@camel.apache.org
Message-ID: <JIRA.13092083.1501740743000.82014.1501744022498@Atlassian.JIRA>
In-Reply-To: <JIRA.13092083.1501740743000@Atlassian.JIRA>
References: <JIRA.13092083.1501740743000@Atlassian.JIRA> <JIRA.13092083.1501740743423@jira-lw-us.apache.org>
Subject: [jira] [Commented] (CAMEL-11625) Potential SQL injection in
 JdbcAggregationRepository
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
archived-at: Thu, 03 Aug 2017 07:07:12 -0000


    [ https://issues.apache.org/jira/browse/CAMEL-11625?page=3Dcom.atlassia=
n.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D161=
12307#comment-16112307 ]=20

Claus Ibsen commented on CAMEL-11625:
-------------------------------------

And btw its the repository name, that the end user himself configures, its =
not like a dynamic part of a message etc. So any risk is very low.

> Potential SQL injection in JdbcAggregationRepository
> ----------------------------------------------------
>
>                 Key: CAMEL-11625
>                 URL: https://issues.apache.org/jira/browse/CAMEL-11625
>             Project: Camel
>          Issue Type: Improvement
>          Components: camel-sql
>            Reporter: Aur=C3=A9lien Pupier
>             Fix For: Future
>
>
> Quoting Sonar:
> "Applications that execute SQL commands should neutralize any externally-=
provided values used in those commands. Failure to do so could allow an att=
acker to include input that changes the query so that unintended commands a=
re executed, or sensitive data is exposed."
> it is the case at 2 places:
> https://github.com/apache/camel/blame/master/components/camel-sql/src/mai=
n/java/org/apache/camel/processor/aggregate/jdbc/JdbcAggregationRepository.=
java#L288
> https://github.com/apache/camel/blame/master/components/camel-sql/src/mai=
n/java/org/apache/camel/processor/aggregate/jdbc/JdbcAggregationRepository.=
java#L357
> the only variable thing is the "repositoryName" so maybe there are some v=
alidation previously which will avoid to users to inject sql code or it is =
something that only the Camel developer can configure?
> even if it is the case, it might be a good idea to use some "preparedStat=
ement" to avoid sql injection in case previous assumptions are no more true
> I reported here because I didn't see any "security" options on the Camel =
open source JIRA.


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)