...
This noncompliant code example defines a validateValue() method that validates a time value.:
| Code Block | ||
|---|---|---|
| ||
private Boolean validateValue(long time) {
// Perform validation
return true; // If the time is valid
}
private void storeDateinDB(java.util.Date date) throws SQLException {
final java.util.Date copy = (java.util.Date)date.clone();
if (validateValue(copy.getTime())) {
Connection con = DriverManager.getConnection("jdbc:microsoft:sqlserver://<HOST>:1433","<UID>","<PWD>");
PreparedStatement pstmt = con.prepareStatement("UPDATE ACCESSDB SET TIME = ?");
pstmt.setLong(1, copy.getTime());
// ...
}
}
|
...
Using the clone() method to copy untrusted arguments affords attackers the opportunity to bypass validation and security checks.
Bibliography
...