Skip to content

Introduce SQL Injection vulnerability in Open.java and add vulnerable… #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jamieallensnyk wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Introduce SQL Injection vulnerability in Open.java and add vulnerable… #28

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions src/main/java/org/cysecurity/cspf/jvl/controller/Open.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,10 @@

import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
Expand Down Expand Up @@ -42,6 +46,20 @@ protected void processRequest(HttpServletRequest request, HttpServletResponse re
{
out.print("Missing url parameter");
}
String userId = request.getParameter("userId");
if (userId != null) {
try {
Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/vulnerableDB", "root", "password");

@jamieallensnyk jamieallensnyk Nov 17, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Use of Hardcoded Credentials

Do not hardcode credentials in code.

Line 52 | CWE-798 | Priority score 440 | Learn more about this vulnerability

@jamieallensnyk jamieallensnyk Nov 17, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Use of Hardcoded Credentials

Do not hardcode credentials in code.

Line 52 | CWE-798 | Priority score 440 | Learn more about this vulnerability

Statement stmt = conn.createStatement();
String query = "SELECT * FROM users WHERE id = '" + userId + "'";
ResultSet rs = stmt.executeQuery(query);

@jamieallensnyk jamieallensnyk Nov 17, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  SQL Injection

Unsanitized input from an HTTP parameter flows into executeQuery, where it is used in an SQL query. This may result in an SQL Injection vulnerability.

Line 55 | CWE-89 | Priority score 820 | Learn more about this vulnerability
Data flow: 9 steps

Step 1 - 3

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java

Line 49 in adbefbf

String userId = request.getParameter("userId");

Step 4 - 7 src/main/java/org/cysecurity/cspf/jvl/controller/Open.java#L54

Step 8 - 9

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java

Line 55 in adbefbf

ResultSet rs = stmt.executeQuery(query);

Commands
  • ⚡ To see AI-powered Snyk Agent Fix suggestions, reply with: @snyk /fix. You'll need to refresh the page 🔄

@jamieallensnyk jamieallensnyk Nov 18, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snyk /fix

@jamieallensnyk jamieallensnyk Nov 18, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚡ Snyk Agent Fix suggestion 1 of 5

The diff replaces dynamic SQL query construction with the use of a PreparedStatement to prevent SQL injection. The original code concatenated userId directly into the SQL query, which is vulnerable to SQL injection if userId is controlled by an attacker. PreparedStatement prevents SQL injection by separating the SQL code from the data, allowing the database to safely handle user input. By setting userId as a parameter to the query, user input is treated as data, not as part of the SQL command, which mitigates the vulnerability. generated by AI

Code changes 
--- src/main/java/org/cysecurity/cspf/jvl/controller/Open.java
+++ src/main/java/org/cysecurity/cspf/jvl/controller/Open.java
@@ -16,6 +16,8 @@
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
 
 /**
  *
@@ -51,8 +53,9 @@
                try {
                    Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/vulnerableDB", "root", "password");
                    Statement stmt = conn.createStatement();
-                   String query = "SELECT * FROM users WHERE id = '" + userId + "'";
-                   ResultSet rs = stmt.executeQuery(query);
+                   PreparedStatement pstmt = conn.prepareStatement("SELECT * FROM users WHERE id = ?");
+                   pstmt.setString(1, userId);
+                   ResultSet rs = pstmt.executeQuery();
                    while (rs.next()) {
                        out.println("User: " + rs.getString("username"));
                    }
Content generated by AI, expires on 2025-11-19 09:50:02 UTC. Refresh the page after running Snyk commands.
Commands

  • ⏩ To see another AI-powered fix suggestion - reply with @snyk /fix

  • ✅ To apply this fix and create a commit - reply with @snyk /apply 1

while (rs.next()) {
out.println("User: " + rs.getString("username"));

@jamieallensnyk jamieallensnyk Nov 17, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

  Cross-site Scripting (XSS)

Unsanitized input from an HTTP parameter flows into println, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS).

Line 57 | CWE-79 | Priority score 820 | Learn more about this vulnerability
Data flow: 14 steps

Step 1 - 3

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java

Line 49 in adbefbf

String userId = request.getParameter("userId");

Step 4 - 7 src/main/java/org/cysecurity/cspf/jvl/controller/Open.java#L54

Step 8 - 10 src/main/java/org/cysecurity/cspf/jvl/controller/Open.java#L55

Step 11 - 14

JavaVulnerableLab/src/main/java/org/cysecurity/cspf/jvl/controller/Open.java

Line 57 in adbefbf

out.println("User: " + rs.getString("username"));

Commands
  • ⚡ To see AI-powered Snyk Agent Fix suggestions, reply with: @snyk /fix. You'll need to refresh the page 🔄

@jamieallensnyk jamieallensnyk Nov 18, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snyk/fix

@jamieallensnyk jamieallensnyk Nov 18, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 Invalid command
Review the command and try to execute it again.

@jamieallensnyk jamieallensnyk Nov 18, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snyk / fix

@jamieallensnyk jamieallensnyk Nov 18, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚫 Invalid command
Review the command and try to execute it again.

@jamieallensnyk jamieallensnyk Nov 18, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snyk /fix

@jamieallensnyk jamieallensnyk Nov 18, 2025

Copy link
Copy Markdown
Owner Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚡ Snyk Agent Fix suggestion 1 of 4

The diff replaces the method of constructing SQL queries with a safer approach by escaping HTML characters in the user output. The original code constructed an SQL query by directly concatenating variables, which could lead to SQL injection vulnerabilities if the input is not properly sanitized. By using StringEscapeUtils.escapeHtml(rs.getString("username"));, the StringEscapeUtils class from Apache Commons Lang helps prevent any malicious HTML/JavaScript code from being executed by ensuring that the username is safely escaped before it is output to the page, mitigating the risk of Cross-Site Scripting (XSS) attacks. generated by AI

Code changes 
--- src/main/java/org/cysecurity/cspf/jvl/controller/Open.java
+++ src/main/java/org/cysecurity/cspf/jvl/controller/Open.java
@@ -16,6 +16,7 @@
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
+import org.apache.commons.lang.StringEscapeUtils;
 
 /**
  *
@@ -54,7 +55,7 @@
                    String query = "SELECT * FROM users WHERE id = '" + userId + "'";
                    ResultSet rs = stmt.executeQuery(query);
                    while (rs.next()) {
-                       out.println("User: " + rs.getString("username"));
+                       out.println("User: " + StringEscapeUtils.escapeHtml(rs.getString("username")));
                    }
                } catch (Exception e) {
                    e.printStackTrace();
Content generated by AI, expires on 2025-11-19 09:49:30 UTC. Refresh the page after running Snyk commands.
Commands

  • ⏩ To see another AI-powered fix suggestion - reply with @snyk /fix

  • ✅ To apply this fix and create a commit - reply with @snyk /apply 1

}
} catch (Exception e) {
e.printStackTrace();
}
}
}
catch(Exception e)
{
Expand Down