SV.SQL.DBSOURCE

This error detects the situation where the results of a database query are used unchecked to create another database query, which can lead to an SQL Injection attack.

Vulnerability and risk

SQL injections put data in the database at risk. Since unvalidated user input is used in the SQL statement, an attacker can inject any SQL statement they wish to execute. This includes deleting, updating or creating data. It may also be possible to retrieve sensitive data from the database with this type of vulnerability. This vulnerability might be exploited in conjunction with the SV.DATA.DB vulnerability.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

For more information, see Knowledge base parameters.

Example 1

Copy 
     public ResultSet getAllPeopleWithSameLastName(ServletRequest req, Connection con, int userId) throws SQLException {
         Statement statement = con.createStatement();
         ResultSet results = statement.executeQuery("SELECT lastName FROM user_data WHERE userid=" + userId);
         String lastName = results.getString("lastName");
         String query = "SELECT * FROM user_data WHERE lastName = '" + lastName + "'";
         return statement.executeQuery(query);
     }

SV.SQL.DBSOURCE is reported for line 16: 'lastName' contains data coming from the database (line 14) which is concatenated with a constant string and stored in 'query' on line 15. On line 16 'query' is executed as an SQL statement. This means that information from a database is used unchecked in an SQL statement executed on the same or another database. This can be exploited to inject arbitrary SQL statements if database data injection (SV.DATA.DB) is possible.

Related checkers

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.