CVE-2016-4999: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2016-08-05T15:59Z
Repository: https://github.com/dashbuilder/dashbuilder
Language: Java
Files changed: dashbuilder-backend/dashbuilder-dataset-sql/src/main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java, dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLInjectionAttacksTest.java, dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLTestSuite.java
Commit date: 2016-06-27 18:05:57 +0200
Commit message: DASHBUILDE-113: SQL Injection on data set lookup filters

Diff: diff --git a/dashbuilder-backend/dashbuilder-dataset-sql/src/main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java b/dashbuilder-backend/dashbuilder-dataset-sql/src/main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java
index 8020b9c0..5ed206d0 100644
--- a/dashbuilder-backend/dashbuilder-dataset-sql/src/main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java
+++ b/dashbuilder-backend/dashbuilder-dataset-sql/src/main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java
@@ -543,11 +543,13 @@ public class DefaultDialect implements Dialect {
         return "TIMESTAMP '" + dateFormat.format(param) + "'";
     }
 
     @Override
     public String getStringParameterSQL(String param) {
-        return "'" + param + "'";
+        // DASHBUILDE-113: SQL Injection on data set lookup filters
+        String escapedParam = param.replaceAll("'", "''");
+        return "'" + escapedParam + "'";
     }
 
     @Override
     public String getLogicalConditionSQL(LogicalCondition condition) {
         LogicalExprType type = condition.getType();
diff --git a/dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLInjectionAttacksTest.java b/dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLInjectionAttacksTest.java
new file mode 100644
index 00000000..3c40620f
--- /dev/null
+++ b/dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLInjectionAttacksTest.java
@@ -0,0 +1,99 @@
+/*
+ * Copyright 2016 Red Hat, Inc. and/or its affiliates.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.dashbuilder.dataprovider.sql;
+
+import org.dashbuilder.dataset.DataSet;
+import org.dashbuilder.dataset.DataSetGroupTest;
+import org.dashbuilder.dataset.DataSetLookupFactory;
+import org.dashbuilder.dataset.filter.FilterFactory;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
+import org.slf4j.Logger;
+
+import static org.dashbuilder.dataset.ExpenseReportsData.*;
+import static org.junit.Assert.*;
+import static org.mockito.Mockito.*;
+
+@RunWith(MockitoJUnitRunner.class)
+public class SQLInjectionAttacksTest extends SQLDataSetTestBase {
+
+    @Mock
+    Logger logger;
+
+    @Before
+    public void setUp() throws Exception{
+        super.setUp();
+
+        sqlDataSetProvider.log = logger;
+
+        doAnswer(invocationOnMock -> {
+                String sql = (String) invocationOnMock.getArguments()[0];
+                System.out.println(sql);
+                return null;
+        }).when(logger).debug(anyString());
+    }
+
+    @Override
+    public void testAll() throws Exception {
+        testStringFilterInjection();
+    }
+
+    public void testStringFilterInjection() throws Exception {
+        DataSet result = dataSetManager.lookupDataSet(
+                DataSetLookupFactory.newDataSetLookupBuilder()
+                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
+                        .filter(COLUMN_EMPLOYEE, FilterFactory.equalsTo("David' OR EMPLOYEE != 'Toni"))
+                        .buildLookup());
+
+        assertEquals(result.getRowCount(), 0);
+
+        result = dataSetManager.lookupDataSet(
+                DataSetLookupFactory.newDataSetLookupBuilder()
+                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
+                        .filter(COLUMN_EMPLOYEE, FilterFactory.equalsTo("David\" OR EMPLOYEE != \"Toni"))
+                        .buildLookup());
+
+        assertEquals(result.getRowCount(), 0);
+
+        result = dataSetManager.lookupDataSet(
+                DataSetLookupFactory.newDataSetLookupBuilder()
+                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
+                        .filter(COLUMN_EMPLOYEE, FilterFactory.equalsTo("David` OR EMPLOYEE != `Toni"))
+                        .buildLookup());
+
+        assertEquals(result.getRowCount(), 0);
+
+    }
+
+    @Test
+    public void testDropTable() throws Exception {
+        DataSet result = dataSetManager.lookupDataSet(
+                DataSetLookupFactory.newDataSetLookupBuilder()
+                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
+                        .filter(COLUMN_EMPLOYEE, FilterFactory.equalsTo("David'; DROP TABLE 'EXPENSE_REPORTS; SELECT 'a' = 'a"))
+                        .buildLookup());
+
+        result = dataSetManager.lookupDataSet(
+                DataSetLookupFactory.newDataSetLookupBuilder()
+                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
+                        .buildLookup());
+
+        assertEquals(result.getRowCount(), 50);
+    }
+}
diff --git a/dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLTestSuite.java b/dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLTestSuite.java
index 69b76639..eae4f4cc 100644
--- a/dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLTestSuite.java
+++ b/dashbuilder-backend/dashbuilder-dataset-sql/src/test/java/org/dashbuilder/dataprovider/sql/SQLTestSuite.java
@@ -35,10 +35,11 @@ public class SQLTestSuite extends SQLDataSetTestBase {
         super.setUp();
         sqlTestList.add(setUp(new SQLDataSetDefTest()));
         sqlTestList.add(setUp(new SQLDataSetTrimTest()));
         sqlTestList.add(setUp(new SQLTableDataSetLookupTest()));
         sqlTestList.add(setUp(new SQLQueryDataSetLookupTest()));
+        sqlTestList.add(setUp(new SQLInjectionAttacksTest()));
     }
 
     public void testAll() throws Exception {
         for (SQLDataSetTestBase testBase : sqlTestList) {
             testBase.testAll();

Vulnerable code:         return "'" + param + "'";
Fixed code:         // DASHBUILDE-113: SQL Injection on data set lookup filters
        String escapedParam = param.replaceAll("'", "''");
        return "'" + escapedParam + "'";
/*
 * Copyright 2016 Red Hat, Inc. and/or its affiliates.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package org.dashbuilder.dataprovider.sql;

import org.dashbuilder.dataset.DataSet;
import org.dashbuilder.dataset.DataSetGroupTest;
import org.dashbuilder.dataset.DataSetLookupFactory;
import org.dashbuilder.dataset.filter.FilterFactory;
import org.junit.Before;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.mockito.Mock;
import org.mockito.runners.MockitoJUnitRunner;
import org.slf4j.Logger;

import static org.dashbuilder.dataset.ExpenseReportsData.*;
import static org.junit.Assert.*;
import static org.mockito.Mockito.*;

@RunWith(MockitoJUnitRunner.class)
public class SQLInjectionAttacksTest extends SQLDataSetTestBase {

    @Mock
    Logger logger;

    @Before
    public void setUp() throws Exception{
        super.setUp();

        sqlDataSetProvider.log = logger;

        doAnswer(invocationOnMock -> {
                String sql = (String) invocationOnMock.getArguments()[0];
                System.out.println(sql);
                return null;
        }).when(logger).debug(anyString());
    }

    @Override
    public void testAll() throws Exception {
        testStringFilterInjection();
    }

    public void testStringFilterInjection() throws Exception {
        DataSet result = dataSetManager.lookupDataSet(
                DataSetLookupFactory.newDataSetLookupBuilder()
                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
                        .filter(COLUMN_EMPLOYEE, FilterFactory.equalsTo("David' OR EMPLOYEE != 'Toni"))
                        .buildLookup());

        assertEquals(result.getRowCount(), 0);

        result = dataSetManager.lookupDataSet(
                DataSetLookupFactory.newDataSetLookupBuilder()
                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
                        .filter(COLUMN_EMPLOYEE, FilterFactory.equalsTo("David\" OR EMPLOYEE != \"Toni"))
                        .buildLookup());

        assertEquals(result.getRowCount(), 0);

        result = dataSetManager.lookupDataSet(
                DataSetLookupFactory.newDataSetLookupBuilder()
                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
                        .filter(COLUMN_EMPLOYEE, FilterFactory.equalsTo("David` OR EMPLOYEE != `Toni"))
                        .buildLookup());

        assertEquals(result.getRowCount(), 0);

    }

    @Test
    public void testDropTable() throws Exception {
        DataSet result = dataSetManager.lookupDataSet(
                DataSetLookupFactory.newDataSetLookupBuilder()
                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
                        .filter(COLUMN_EMPLOYEE, FilterFactory.equalsTo("David'; DROP TABLE 'EXPENSE_REPORTS; SELECT 'a' = 'a"))
                        .buildLookup());

        result = dataSetManager.lookupDataSet(
                DataSetLookupFactory.newDataSetLookupBuilder()
                        .dataset(DataSetGroupTest.EXPENSE_REPORTS)
                        .buildLookup());

        assertEquals(result.getRowCount(), 50);
    }
}
        sqlTestList.add(setUp(new SQLInjectionAttacksTest()));