Page History

...

Code Block

bgColor	#ccccff

  public void doPrivilegedAction(String username, char[] password) throws SQLException {
    Connection connection = getConnection();
    if (connection == null) {
      // handle error
    }
    String pwd = hashPassword(password);

    // Ensure that the length of user name is legitimate
    if ((username.length() > 8) {
      // Handle error
    }

    String sqlString = "select * from db_user where username=? and password=?";
    PreparedStatement stmt = connection.prepareStatement(sqlString);
    stmt.setString(1, username);
    stmt.setString(2, pwd);
    ResultSet rs = stmt.executeQuery();
    if (!rs.next()) {
      throw new SecurityException("User name or password incorrect");
    }

    // Authenticated; proceed
  }

...

CERT C Secure Coding Standard	STR02-C. Sanitize data passed to complex subsystems
CERT C++ Secure Coding Standard	STR02-CPP. Sanitize data passed to complex subsystems
CVE-2008-2370	describes a vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. When a `RequestDispatcher` is used, Tomcat performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="053ab0e80ae0d11f-69a3814b-439c47af-b88fa28b-b8b6c34ed50235630a66ea4e"><ac:plain-text-body><![CDATA[	[ISO/IEC TR 24772:2010	http://www.aitcnet.org/isai/]	"Injection [RST]"	]]></ac:plain-text-body></ac:structured-macro>
MITRE CWE	CWE-116, "Improper Encoding or Escaping of Output"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="f485a01918e59bb3-bbcb5dfa-41d348c6-936693ab-48e7a36f26ac2c9ea3092030"><ac:plain-text-body><![CDATA[	[[OWASP 2005	AA. Bibliography#OWASP 05]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d6520fe924d138ec-cbfa63f5-44f2471f-8af4961d-019df895c55d762c25e26c41"><ac:plain-text-body><![CDATA[	[[OWASP 2007	AA. Bibliography#OWASP 07]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="4f6517628c62a524-8f92d675-40d0462e-8d3388e3-85d10667496aea710c4e716d"><ac:plain-text-body><![CDATA[	[[OWASP 2008	AA. Bibliography#OWASP 08]]	[Testing for XML Injection (OWASP-DV-008)	https://www.owasp.org/index.php/Testing_for_XML_Injection_%28OWASP-DV-008%29]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a81df80ac8421880-6dde40da-4cf14f93-b4e1a476-40536d48023395d7c5c7a6c2"><ac:plain-text-body><![CDATA[	[[W3C 2008	AA. Bibliography#W3C 08]]	4.4.3 Included If Validating	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 98

New Version 99

Key