Page History

...

Code Block

bgColor	#ccccff

  public void doPrivilegedAction(
    String username, char[] password
  ) throws SQLException {
    Connection connection = getConnection();
    if (connection == null) {
      // Handle error
    }
    try {
      String pwd = hashPassword(password);

      // Ensure that the length of user name is legitimate
      if ((username.length() > 8) {
        // Handle error
      }

      String sqlString = 
        "select * from db_user where username=? and password=?";
      PreparedStatement stmt = connection.prepareStatement(sqlString);
      stmt.setString(1, username);
      stmt.setString(2, pwd);
      ResultSet rs = stmt.executeQuery();
      if (!rs.next()) {
        throw new SecurityException("User name or password incorrect");
      }

      // Authenticated, proceed
    } finally {
      try {
        connection.close();
      } catch (SQLException x) {
        // forward to handler
      }
    }
  }

...

CERT C Secure Coding Standard	STR02-C. Sanitize data passed to complex subsystems
CERT C++ Secure Coding Standard	STR02-CPP. Sanitize data passed to complex subsystems
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="413ea3a6f32a6bfc-58b288e0-4374418f-98d3a6ea-50d9105399548ff6909a797e"><ac:plain-text-body><![CDATA[	[ISO/IEC TR 24772:2010	http://www.aitcnet.org/isai/]	Injection [RST]	]]></ac:plain-text-body></ac:structured-macro>
MITRE CWE	CWE-116. Improper encoding or escaping of output

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e9b88f37dba07bba-87dcb940-404b4a33-b09ab69f-77042da5ac328e10c817caea"><ac:plain-text-body><![CDATA[	[[OWASP 2005	AA. References#OWASP 05]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a6313be66f3967f2-562336a7-46174dcd-9c26a35f-b400c1aabc6dfd46242cf26a"><ac:plain-text-body><![CDATA[	[[OWASP 2007	AA. References#OWASP 07]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="854ae4e67280a778-9466de0b-41a64f13-b6a8add0-f250f40e0e478553f5c14fa5"><ac:plain-text-body><![CDATA[	[[OWASP 2008	AA. References#OWASP 08]]	[Testing for XML Injection (OWASP-DV-008)	https://www.owasp.org/index.php/Testing_for_XML_Injection_%28OWASP-DV-008%29]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0f69b781acf16a07-4524eedb-429e4a3e-a0e68d03-eb27318f4bc902989979c17c"><ac:plain-text-body><![CDATA[	[[W3C 2008	AA. References#W3C 08]]	4.4.3, Included If Validating	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 114

New Version 115

Key