Hibernate - Revision history

Imifos: correct rectification

2016-02-02T14:31:58Z

correct rectification

Imifos: fixing category

2015-12-01T13:01:50Z

fixing category

Jarrod Stenberg: /* Creating, manipulating and executing queries */

2015-04-30T15:22:48Z

‎Creating, manipulating and executing queries

Nawwar: /* Persisting tainted data */ correcting inconsistent variable name

2015-03-11T17:07:54Z

‎Persisting tainted data: correcting inconsistent variable name

KirstenS: /* More Examples */

2009-04-20T01:45:13Z

‎More Examples

KirstenS: /* Creating, manipulating and executing queries */

2009-04-20T01:44:36Z

‎Creating, manipulating and executing queries

Tehmina: /* Persisting tainted data */

2008-06-05T18:37:28Z

‎Persisting tainted data

Tehmina at 18:35, 5 June 2008

2008-06-05T18:35:16Z

Tehmina: /* Creating, manipulating and executing queries */

2008-06-05T17:31:00Z

‎Creating, manipulating and executing queries

Tehmina: /* Persisting tainted data */

2008-06-05T17:28:37Z

‎Persisting tainted data

← Older revision		Revision as of 14:31, 2 February 2016
Line 294:		Line 294:

	[[Category:Hibernate]]		[[Category:Hibernate]]
−	[[Category:~~OWASP~~ Java ~~Project~~]]	+	[[Category:Java]]

← Older revision		Revision as of 13:01, 1 December 2015
Line 295:		Line 295:
	[[Category:Hibernate]]		[[Category:Hibernate]]
	[[Category:OWASP Java Project]]		[[Category:OWASP Java Project]]
−	~~[[Category:Java]]~~

@@ Line 152: / Line 152: @@
 Consider this example:
 <pre>
-      String table = (String) req.getParameter("table");//obviously retarded
+      String table = (String) req.getParameter("table");//obviously prone to tainted input
       String parameter1 = request.getParameter("param1");

@@ Line 263: / Line 263: @@
 Consider this example:
 <pre>
-      Session session = sessionFactory.getCurrentSession();
+      Session session  = sessionFactory.getCurrentSession();
-      String firstname = req.getParameter("firstname");
+      String firstname = request.getParameter("firstname");
-      String lastname = request.getParameter("lastname");
+      String lastname  = request.getParameter("lastname");
       try{

@@ Line 176: / Line 176: @@
-Using queries from other Query's:
+Using queries from other Queries:
 <pre>
       String sql;

@@ Line 148: / Line 148: @@
 * The Session interface defines methods that create Query and SQLQuery objects - these are the methods we care about because they allow the developer to construct query strings (as opposed to letting Hibernate perform the sql operations).
 * The Query/SQLQuery objects are mutable and executable, but are not actually SUNK until Transaction.commit(), or Query.executeUpdate() is called. However, I think it is best that we flag functions that create and construct Query objects as they would be in direct contact with tainted data.
-* Once a Query or SQLQuery object is obtained from the Session, the parameters of it's sql string should be set using the setter functions like setParameter(), the setters are listed here. These setters check for type mismatch, or guess the type, then check for positional mismatch and named parameter mismatch so they're pretty safe me thinks. Concatenating tainted parameters using the '+' operator, on the other hand, would be equivalent to mis-using a prepared-statement.
+* Once a Query or SQLQuery object is obtained from the Session, the parameters of its sql string should be set using the setter functions like setParameter(), the setters are listed here. These setters check for type mismatch, or guess the type, then check for positional mismatch and named parameter mismatch so they're pretty safe me thinks. Concatenating tainted parameters using the '+' operator, on the other hand, would be equivalent to mis-using a prepared-statement.
 Consider this example:

← Older revision		Revision as of 18:37, 5 June 2008
Line 294:		Line 294:

	[[Category:Hibernate]]		[[Category:Hibernate]]
		+	[[Category:OWASP Java Project]]
		+	[[Category:Java]]

@@ Line 1: / Line 1: @@
 == Status ==
-== Headline text ==
+'''In progress'''
 == Before you begin ==
 Since ORM architecture isn't obvious, this document will explain some important things you need to know in order to analyze a Hibernate application in a security context.  This document assumes some SQL and database knowledge.

@@ Line 173: / Line 173: @@
 * Query.executeUpdate() -
 * Query.getQueryString() -
 == Persisting tainted data ==

← Older revision		Revision as of 17:28, 5 June 2008
Line 176:		Line 176:
	== Persisting tainted data ==		== Persisting tainted data ==

		+	* Assume persistent objects have JavaBeans style setter methods as this is most common practice. When these setters are called with tainted parameters consider this object to be tainted.
		+	* We should flag all functions where tainted objects are made persistent. Although most documents will define Session.save() or Session.persist() as making an object persistent, it is actually PENDING until a call to Transaction.commit() is made. Whether or not we want to flag the saves, or the commits is up to scan dev - keep in mind that if we're flagging commit() we must first decide that the code between Transaction.begin() or Session.beginTransaction() and Transaction.commit() contains eevil.
		+	* The only associated cwe I can think of right now is stored xss.

		+	Consider this example:
		+	<pre>
		+	Session session = sessionFactory.getCurrentSession();
		+	String firstname = req.getParameter("firstname");
		+	String lastname = request.getParameter("lastname");
		+
		+	try{
		+	Transaction tx = session.beginTransaction();
		+
		+	Person thePerson = session.load(Person.class, new Long(69));//loading an already persistent object
		+	thePerson.setFirstname(firstname);// then adding tainted data to it
		+	thePerson.setLastname(lastname);
		+	session.save(thePerson); //persisting our changes
		+
		+	session.getTransaction().commit();
		+	} catch (Exception e) {
		+	if (tx!=null) tx.rollback();
		+	throw e;
		+	}
		+	session.close();
		+	</pre>
		+	Most Common Functions:
		+
		+	* Session.save(Object object) - save object to the session, object should not contain tainted data.
		+	* Session.persist(Object object) -
		+	* Session.void replicate(Object object, ReplicationMode?? replicationMode) -
		+	* Session.void saveOrUpdate(Object object) -
		+	* Session.update(Object object)() -
		+	* Session.evict(Object object)() - remove instance from session cache
		+	* Session.clear() - evict all loaded instances
		+	* Session.load(Class theClass, Serializable id) - gets an object from the db for you to manipulate.

	[[Category:Hibernate]]		[[Category:Hibernate]]