CRV2 SQLInjHQL - Revision history

Larry Conklin at 02:46, 17 June 2014

2014-06-17T02:46:10Z

Larry Conklin at 02:45, 17 June 2014

2014-06-17T02:45:28Z

Larry Conklin at 02:44, 17 June 2014

2014-06-17T02:44:56Z

Larry Conklin at 02:44, 17 June 2014

2014-06-17T02:44:28Z

Larry Conklin at 21:42, 15 June 2014

2014-06-15T21:42:23Z

Larry Conklin at 21:40, 15 June 2014

2014-06-15T21:40:44Z

Larry Conklin: Created page with "==Hibernate Query Language (HQL)== Hibernate facilitates the storage and retrieval of Java domain objects via Object/Relational Mapping (ORM). It is a very common misconcep..."

2014-06-15T21:35:29Z

Created page with "==Hibernate Query Language (HQL)== Hibernate facilitates the storage and retrieval of Java domain objects via Object/Relational Mapping (ORM). It is a very common misconcep..."

New page

==Hibernate Query Language (HQL)==

Hibernate facilitates the storage and retrieval of Java domain objects via Object/Relational Mapping (ORM).

It is a very common misconception that ORM solutions, like hibernate, are SQL Injection proof. Hibernate allows the use of "native SQL" and defines a proprietary query language, called HQL (Hibernate Query Language); the former is prone to SQL Injection and the later is prone to HQL (or ORM) injection.

@@ Line 4: / Line 4: @@
 It is a very common misconception that ORM solutions, like hibernate, are SQL Injection proof. Hibernate allows the use of "native SQL" and defines a proprietary query language, called HQL (Hibernate Query Language); the former is prone to SQL Injection and the later is prone to HQL (or ORM) injection.
 ==Bad Java Code Examples==
@@ Line 19: / Line 16: @@
   + ItemName.Text + "'";
   List items = sess.CreateSQLQuery(query).List()

@@ Line 16: / Line 16: @@
   string userName = ctx.GetAuthenticatedUserName();
   String query = "SELECT * FROM Items WHERE owner = '"
-				+ userName + "' AND itemname = '"
+ + userName + "' AND itemname = '"
-				+ ItemName.Text + "'";
+ + ItemName.Text + "'";
   List items = sess.CreateSQLQuery(query).List()

@@ Line 14: / Line 14: @@
 ==Bad .Net Code Example==
-string userName = ctx.GetAuthenticatedUserName();
+ string userName = ctx.GetAuthenticatedUserName();
-String query = "SELECT * FROM Items WHERE owner = '"
+ String query = "SELECT * FROM Items WHERE owner = '"
 				+ userName + "' AND itemname = '"
 				+ ItemName.Text + "'";
-List items = sess.CreateSQLQuery(query).List()
+ List items = sess.CreateSQLQuery(query).List()

@@ Line 8: / Line 8: @@
 Code reviewer needs to make sure any data used in an HQL query uses HQL parameterized queries so that it would be used as data and not as code.
-==Bad code examples==
+==Bad Java Code Examples==
   List results = session.createQuery("from Items as item where item.id = " + currentItem.getId()).list();

@@ Line 6: / Line 6: @@
 ==Code Reviewer Action==
-Code reviewer needs to make sure any data uses HQL parameterized queries such that it would be used as data and not as code.
+Code reviewer needs to make sure any data used in an HQL query uses HQL parameterized queries so that it would be used as data and not as code.
 ==Bad code examples==
   List results = session.createQuery("from Items as item where item.id = " + currentItem.getId()).list();

← Older revision		Revision as of 21:40, 15 June 2014
Line 4:		Line 4:

	It is a very common misconception that ORM solutions, like hibernate, are SQL Injection proof. Hibernate allows the use of "native SQL" and defines a proprietary query language, called HQL (Hibernate Query Language); the former is prone to SQL Injection and the later is prone to HQL (or ORM) injection.		It is a very common misconception that ORM solutions, like hibernate, are SQL Injection proof. Hibernate allows the use of "native SQL" and defines a proprietary query language, called HQL (Hibernate Query Language); the former is prone to SQL Injection and the later is prone to HQL (or ORM) injection.
		+
		+	==Code Reviewer Action==
		+	Code reviewer needs to make sure any data uses HQL parameterized queries such that it would be used as data and not as code.
		+
		+	==Bad code examples==
		+	List results = session.createQuery("from Items as item where item.id = " + currentItem.getId()).list();