Mailing-List: contact empire-db-dev-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: empire-db-dev@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of francisdb@gmail.com
 designates 209.85.220.228 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:in-reply-to:references:from:date:message-id:subject:to
         :content-type:content-transfer-encoding;
        b=oAdjnaknJwYsWXxRVPaI1zkHtTF0twDSwrU4i1R1j3Yovv7WpLTm4hc2vKo5Mt128z
         AsUWteP16E8sBN9pOeOEK6t5kD4tAbOtXe0YR/81tyMZPIfSE+GDCxecxdRwsd1KJzgl
         +GtARfXY3/C7BFrWlPSGB0JsS2Jxjoybt3xYI=
MIME-Version: 1.0
In-Reply-To: <a747219a1001261622q6cfcc60dy60bad3ab84753fa4@mail.gmail.com>
References: <a747219a1001180731q4d793c6bt67ee77d1bd70395@mail.gmail.com>
	<a747219a1001200420x48b8c134n8eacb236e266008d@mail.gmail.com>
	<B297D4737108A0459B66C3A85BB7F901147961@kn.esteam.de>
 <a747219a1001240709k37ca944ta5c6f21f5feee5ec@mail.gmail.com>
	<B297D4737108A0459B66C3A85BB7F901147962@kn.esteam.de>
 <a747219a1001241256p2de652fqb565429b2e8753ee@mail.gmail.com>
	<B297D4737108A0459B66C3A85BB7F901147963@kn.esteam.de>
 <a747219a1001241402o3082cfd7la07620fbccbdd432@mail.gmail.com>
	<B297D4737108A0459B66C3A85BB7F901147991@kn.esteam.de>
 <a747219a1001261622q6cfcc60dy60bad3ab84753fa4@mail.gmail.com>
From: Francis De Brabandere <francisdb@gmail.com>
Date: Wed, 27 Jan 2010 07:32:41 +0100
Message-ID: <3ab983231001262232n66471e77u451e26a97986f2ac@mail.gmail.com>
Subject: Re: Type checks in DBCommand in order to avoid SQL Injection
To: empire-db-dev@incubator.apache.org
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

Would it be possible to somehow use prepared statements for this?

On Wed, Jan 27, 2010 at 1:22 AM, McKinley <mckinley1411@gmail.com> wrote:
> Would the check go into that the addSQL() ->
> getObjectValue(expr.getDataType()... chain? In the case of my example,
> I have passed in a string so rather than give too much deference to
> the column data type, why not say "rare is the DBMS that will cast
> this correctly, but the developer seems to want [where intCol1 =3D '0;
> update this set that=3D\'bla\';']. Of course this requires adding a
> bunch of type checks on that Object value that was passed to determine
> that it is a string and should be quoted. I don't think I want any
> parseInt or regexp for ';' and '--'. Just quote wrapping when the
> value is character based.
>
> If you do add checks how about changing addSql() to addSql(boolean
> safe)? addSql() would do any checks, but if you have white-listed all
> your inputs you can use addSql(false) to get extra speed.
>
> I guess another option is that checks could be put into the
> DBCompareColExpr generators like is() and isBetween() so that they
> take specific types instead of Object, but that might be too much
> boilerplate code.
>
> Thanks,
>
> McKinley
>
>
> On Tue, Jan 26, 2010 at 11:37 PM, Rainer D=F6bele <doebele@esteam.de> wro=
te:
>> Hi McKinley
>>
>> Just to let you know:
>> In the Where clause of the DBCommand object we're not doing any type che=
cks at all.
>> Hence your SQL-Injection example below also works for other numeric colu=
mns.
>>
>> The question is whether we should at this point or not.
>> We're doing type-checks when working with DBRecord objects.
>> They internally then use a DBCommand as well.
>> Adding a check in DBCommand would mean a double check.
>>
>> I think the DBCommand is the lowest level.
>> All checks should be performed at a higher level in order to avoid Overh=
ead.
>>
>> Regards
>> Rainer
>


--=20
http://www.somatik.be
Microsoft gives you windows, Linux gives you the whole house.