CVE-2015-10048: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)
value: A vulnerability was found in bmattoso desafio_buzz_woody. It has been rated as critical. This issue affects some unknown processing. The manipulation leads to sql injection. The identifier of the patch is cb8220cbae06082c969b1776fcb2fdafb3a1006b. It is recommended to apply a patch to fix this issue. The identifier VDB-218357 was assigned to this vulnerability.
CWE description: The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
CVSS v3 base score: 9.8
Published: 2023-01-15T10:15Z
Repository: https://github.com/bmattoso/desafio_buzz_woody
Language: Java
Files changed: injectIt/src/main/java/com/dextra/injectit/database/Database.java, injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java, injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java, injectIt/target/injectIt-1.0-SNAPSHOT/index.html, injectIt/target/injectIt-1.0-SNAPSHOT/js/index.js, injectIt/target/injectIt-1.0-SNAPSHOT/templates/template.html, injectIt/target/maven-archiver/pom.properties, injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst, injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst, injectIt/target/tomcat/logs/access_log.2015-02-08
Commit date: 2015-02-09 00:18:57 -0200
Commit message: Método de execute alterado para SQLINJECTION , faltando apenas o método de StoredProcedure

Diff: diff --git a/injectIt/src/main/java/com/dextra/injectit/database/Database.java b/injectIt/src/main/java/com/dextra/injectit/database/Database.java
index 4ba84cb..28ae07c 100644
--- a/injectIt/src/main/java/com/dextra/injectit/database/Database.java
+++ b/injectIt/src/main/java/com/dextra/injectit/database/Database.java
@@ -1,13 +1,17 @@
 package com.dextra.injectit.database;
 
+import java.sql.CallableStatement;
 import java.sql.Connection;
 import java.sql.DriverManager;
+import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
 
+import sun.security.provider.ConfigFile.Spi;
+
 public class Database {
 
 	private Database() {
 	}
 
@@ -17,27 +21,67 @@ public class Database {
 		} catch (SQLException e) {
 			throw new RuntimeException(e);
 		}
 	}
 
+	public static ResultSet executeStoredPrcedure(String spCalled, Object... parameters){
+		Connection conn = getConnection();
+		CallableStatement cs = null;
+
+		try {
+			cs = conn.prepareCall(spCalled);
+			if (parameters != null)
+				for (int parameterIndex = 0; parameterIndex < parameters.length; ++parameterIndex){
+					cs.setObject(parameterIndex + 1, parameters[parameterIndex]);
+				}
+			System.out.println(cs.toString());
+			if (cs.execute())
+				return  cs.executeQuery();	
+			else 
+				return null;
+		} catch (SQLException e) {
+		
+			throw new RuntimeException(e);
+		
+		} finally {
+			try {
+				if (cs != null) {
+					cs.close();
+				}
+				conn.close();
+			} catch (SQLException e) {
+				throw new RuntimeException(e);
+			}
+		}
+	}
+	
 	public static ResultSet execute(String sql, Object... objects) {
 		Connection conn = getConnection();
-		Statement s = null;
+		PreparedStatement ps = null;
 		
 		try {
-			s = conn.createStatement();
-			if (s.execute(sql)) {
-				return s.getResultSet();
-			} else {
+			System.out.println(sql);
+			ps = conn.prepareStatement(sql);
+			
+			// Set the parameters
+			if (objects != null)
+				for (int parameterIndex = 0; parameterIndex < objects.length; ++parameterIndex){
+					ps.setObject(parameterIndex + 1, objects[parameterIndex]);
+				}
+			
+			if (ps.execute())
+				return ps.getResultSet();
+			else
 				return null;
-			}
+			
 		} catch (SQLException e) {
+			e.printStackTrace();
 			throw new RuntimeException(e);
 		} finally {
 			try {
-				if (s != null) {
-					s.close();
+				if (ps != null) {
+					ps.close();
 				}
 				conn.close();
 			} catch (SQLException e) {
 				throw new RuntimeException(e);
 			}
diff --git a/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java b/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
index 859a39e..50e7765 100644
--- a/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
+++ b/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
@@ -6,10 +6,18 @@ public class MockDatabase {
 
 		String create = "CREATE TABLE user (name VARCHAR(50) NOT NULL, "
 				+ "password VARCHAR(100) NOT NULL, "
 				+ "creditCardNumber VARCHAR(12) NOT NULL)";
 		Database.execute(create);
+		
+		String sp = "CREATE PROCEDURE sp_getUser "
+				+ "(@user VARCHAR(100)) "
+				+ "AS "
+				+ "BEGIN "
+				+ "SELECT * FROM USER WHERE NAME = @user "
+				+ "END";
+		Database.execute(sp);
 
 		insertUser("Guilherme", "EuAmoGatinhos", "123456789012");
 		insertUser("Bruno", "LaFooon", "187456779012");
 		insertUser("Jefferson", "DaniboySZ", "487456789012");
 		insertUser("Leonardo", "MinoZica2014", "587456789112");
diff --git a/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java b/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
index b78e3ec..ce42cd1 100644
--- a/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
+++ b/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
@@ -10,10 +10,11 @@ import javax.servlet.ServletOutputStream;
 import javax.servlet.http.HttpServlet;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
 import com.dextra.injectit.database.Database;
+import com.dextra.injectit.database.MockDatabase;
 import com.dextra.injectit.database.User;
 import com.google.gson.Gson;
 
 public class InjectServlet extends HttpServlet {
 
@@ -64,13 +65,15 @@ public class InjectServlet extends HttpServlet {
 	protected void doPost(HttpServletRequest req, HttpServletResponse resp)
 			throws ServletException, IOException {
 		
 		// Nome dos usuario pesquisado
 		String name = req.getParameter("name");
+		String[] names = new String[1];
+		names[0] = name;
 		
-		String query = "SELECT * FROM USER WHERE NAME = '" + name + "'";
-		ResultSet users = Database.execute(query);
+		String query = "SELECT * FROM USER WHERE NAME = ?";
+		ResultSet users = Database.execute(query,names);
 		
 		ArrayList<User> searchedUsers = new ArrayList<User>();
 		try {
 			
 			while (users.next()){
@@ -91,25 +94,31 @@ public class InjectServlet extends HttpServlet {
 	}
 	
 	public static void main(String[] args) {
 		/////////////////
 		// TESTE DE SQL INJECTION
+		try {
+			MockDatabase.execute();
+			
+			
+			String query = "{call sp_getUser(?)}";
 		
+			Object []objs = new Object [1];
+			objs[0] = "Jefferson";
+			
+			ResultSet users = Database.executeStoredPrcedure(query, objs);
 		
-		String query = "SELECT * FROM USER WHERE NAME = ?";
-		ResultSet users = Database.execute(query);
+			ArrayList<User> searchedUsers = new ArrayList<User>();
 		
-		ArrayList<User> searchedUsers = new ArrayList<User>();
-		try {
 			
 			while (users.next()){
 				searchedUsers.add(new User(users.getString(1),users.getString(2),users.getString(3)));
 			}
 			
 			Gson gson = new Gson();
 			System.out.println(gson.toJson(searchedUsers));
 
-		} catch (SQLException e) {
+		} catch (Exception e) {
 			e.printStackTrace();
 		}	
 	}
 }
diff --git a/injectIt/target/classes/com/dextra/injectit/database/Database.class b/injectIt/target/classes/com/dextra/injectit/database/Database.class
index f805628..e5af0d0 100644
Binary files a/injectIt/target/classes/com/dextra/injectit/database/Database.class and b/injectIt/target/classes/com/dextra/injectit/database/Database.class differ
diff --git a/injectIt/target/classes/com/dextra/injectit/database/MockDatabase.class b/injectIt/target/classes/com/dextra/injectit/database/MockDatabase.class
index 30c1573..ae05309 100644
Binary files a/injectIt/target/classes/com/dextra/injectit/database/MockDatabase.class and b/injectIt/target/classes/com/dextra/injectit/database/MockDatabase.class differ
diff --git a/injectIt/target/classes/com/dextra/injectit/servlets/InjectServlet.class b/injectIt/target/classes/com/dextra/injectit/servlets/InjectServlet.class
index 50d6323..6247c77 100644
Binary files a/injectIt/target/classes/com/dextra/injectit/servlets/InjectServlet.class and b/injectIt/target/classes/com/dextra/injectit/servlets/InjectServlet.class differ
diff --git a/injectIt/target/injectIt-1.0-SNAPSHOT.war b/injectIt/target/injectIt-1.0-SNAPSHOT.war
index 410a0fd..6fda77a 100644
Binary files a/injectIt/target/injectIt-1.0-SNAPSHOT.war and b/injectIt/target/injectIt-1.0-SNAPSHOT.war differ
diff --git a/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/Database.class b/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/Database.class
index daa0af9..58f074d 100644
Binary files a/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/Database.class and b/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/Database.class differ
diff --git a/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/MockDatabase.class b/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/MockDatabase.class
index 2689aac..b124a16 100644
Binary files a/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/MockDatabase.class and b/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/MockDatabase.class differ
diff --git a/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/User.class b/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/User.class
index 22255fe..31b65e4 100644
Binary files a/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/User.class and b/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/database/User.class differ
diff --git a/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/servlets/InjectServlet.class b/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/servlets/InjectServlet.class
index 77a26fc..fdc5c2b 100644
Binary files a/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/servlets/InjectServlet.class and b/injectIt/target/injectIt-1.0-SNAPSHOT/WEB-INF/classes/com/dextra/injectit/servlets/InjectServlet.class differ
diff --git a/injectIt/target/injectIt-1.0-SNAPSHOT/index.html b/injectIt/target/injectIt-1.0-SNAPSHOT/index.html
index 98f0209..9f60524 100644
--- a/injectIt/target/injectIt-1.0-SNAPSHOT/index.html
+++ b/injectIt/target/injectIt-1.0-SNAPSHOT/index.html
@@ -1,15 +1,18 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
 <html>
 <head>
 <meta http-equiv="Content-Type" content="text/html;charset=UTF-8">
-<script src="http://code.jquery.com/jquery-2.1.3.js"
-	type="text/javascript"></script>
 </head>
 <body>
 	<label for="search">Nome:</label>
 	<input type="text" id="search" name="search" />
 	<input type="button" value="Pesquisar" id="pesquisar" />
 	<div id="usuarios">
 	</div>
+	
+	<script src="http://code.jquery.com/jquery-2.1.3.js" type="text/javascript"></script>
+	<script src="js/index.js" type="text/javascript"></script>
+	<script src="js/doT.js" type="text/javascript"></script>
+	
 </body>
 </html>
\ No newline at end of file
diff --git a/injectIt/target/injectIt-1.0-SNAPSHOT/js/index.js b/injectIt/target/injectIt-1.0-SNAPSHOT/js/index.js
index baeb5b5..4ecbf18 100644
--- a/injectIt/target/injectIt-1.0-SNAPSHOT/js/index.js
+++ b/injectIt/target/injectIt-1.0-SNAPSHOT/js/index.js
@@ -1,18 +1,29 @@
-    $.ajax({
-        url : 'api/usuarios',
-        type : "GET",
-    }).done(function(resp) {
-        $("#usuarios").html(resp);
-    });
+$(document).ready(function(){
+	$.ajax({
+		type : 'GET',
+		url : 'api/usuarios',
+		dataType : 'json'
+	}).success(function(strJson) {
+		$.get('templates/template.html').done(function(template) {
+			$('#usuarios').html(doT.template(template)(strJson));
+		});
+	})
+});
 
-    $("#pesquisar").click(function() {
-        $.ajax({
-            url : 'api/usuarios',
-            type : "GET",
-            data : {
-                name : $("#search").val()
-            }
-        }).done(function(resp) {
-            $("#usuarios").html(resp);
-        });
-    });
+$('#pesquisar').click(function() {
+
+	$.ajax({
+		url : 'api/usuarios',
+		type : 'POST',
+		data : {
+			name : $('#search').val()
+		},
+		dataType : 'json'
+	}).done(function(resp) {
+		console.info(resp);
+		$.get('templates/template.html',function (template){
+			$("#usuarios").html(doT.template(template)(resp));
+		}, "html");
+
+	});
+});
\ No newline at end of file
diff --git a/injectIt/target/injectIt-1.0-SNAPSHOT/templates/template.html b/injectIt/target/injectIt-1.0-SNAPSHOT/templates/template.html
index 578a933..0ec832e 100644
--- a/injectIt/target/injectIt-1.0-SNAPSHOT/templates/template.html
+++ b/injectIt/target/injectIt-1.0-SNAPSHOT/templates/template.html
@@ -4,15 +4,17 @@
 		<th>Nome: </th>
 		<th>Senha: </th>
 		<th>Numero do cartao: </th>
 	</tr>
 </thead>
-<tbody>
-{{~it : client}}
+<tbody> 
+{{console.info(it);}}
+{{~it :user}}
 <tr>
-	<td>{{=client.name}}</td>
-	<td>{{=client.password}}</td>
-	<td>{{=client.creditCardNumber}}</td>
+	{{console.info();}}
+	<td>{{=user.name}}</td>
+	<td>{{=user.password}}</td>
+	<td>{{=user.creditCardNumber}}</td>
 </tr>
 {{~}}
 </tbody>
 </table>
\ No newline at end of file
diff --git a/injectIt/target/maven-archiver/pom.properties b/injectIt/target/maven-archiver/pom.properties
index 4fa5c3e..9bbb02d 100644
--- a/injectIt/target/maven-archiver/pom.properties
+++ b/injectIt/target/maven-archiver/pom.properties
@@ -1,5 +1,5 @@
 #Generated by Maven
-#Fri Feb 06 13:33:32 BRST 2015
+#Sun Feb 08 22:05:57 BRST 2015
 version=1.0-SNAPSHOT
 groupId=com.dextra.injectIt
 artifactId=injectIt
diff --git a/injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst b/injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst
index bfee670..373dd2e 100644
--- a/injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst
+++ b/injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/createdFiles.lst
@@ -1,11 +1,5 @@
-<<<<<<< HEAD
 com/dextra/injectit/servlets/InjectServlet.class
 com/dextra/injectit/database/MockDatabase.class
+com/dextra/injectit/database/User.class
 com/dextra/injectit/booter/ContextListener.class
-=======
-com/dextra/injectit/database/MockDatabase.class
->>>>>>> a83373cb29646b4fd9576b44d0ae4a4128cd7637
 com/dextra/injectit/database/Database.class
-com/dextra/injectit/booter/ContextListener.class
-com/dextra/injectit/servlets/InjectServlet.class
-com/dextra/injectit/database/User.class
diff --git a/injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst b/injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst
index c681d01..bb22578 100644
--- a/injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst
+++ b/injectIt/target/maven-status/maven-compiler-plugin/compile/default-compile/inputFiles.lst
@@ -1,13 +1,5 @@
-<<<<<<< HEAD
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
-/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
-=======
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
-/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
->>>>>>> a83373cb29646b4fd9576b44d0ae4a4128cd7637
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
+/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
diff --git a/injectIt/target/tomcat/logs/access_log.2015-02-08 b/injectIt/target/tomcat/logs/access_log.2015-02-08
new file mode 100644
index 0000000..60e61d5
--- /dev/null
+++ b/injectIt/target/tomcat/logs/access_log.2015-02-08
@@ -0,0 +1,10 @@
+127.0.0.1 - - [08/Feb/2015:22:34:56 -0200] "GET / HTTP/1.1" 404 - http-bio-8080-exec-1 0
+127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt HTTP/1.1" 302 - http-bio-8080-exec-2 0
+127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/ HTTP/1.1" 200 582 http-bio-8080-exec-3 215
+127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/js/index.js HTTP/1.1" 200 597 http-bio-8080-exec-4 7
+127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/js/doT.js HTTP/1.1" 200 5163 http-bio-8080-exec-5 31
+127.0.0.1 - - [08/Feb/2015:22:35:06 -0200] "GET /injectIt/api/usuarios HTTP/1.1" 405 1065 http-bio-8080-exec-7 4
+127.0.0.1 - - [08/Feb/2015:22:35:10 -0200] "POST /injectIt/api/usuarios HTTP/1.1" 200 12 http-bio-8080-exec-8 58
+127.0.0.1 - - [08/Feb/2015:22:35:10 -0200] "GET /injectIt/templates/template.html HTTP/1.1" 200 296 http-bio-8080-exec-9 27
+127.0.0.1 - - [08/Feb/2015:22:35:14 -0200] "POST /injectIt/api/usuarios HTTP/1.1" 200 84 http-bio-8080-exec-10 10
+127.0.0.1 - - [08/Feb/2015:22:54:04 -0200] "GET /help/topic/com.vmware.ICbase/images/vmware_favicon.ico HTTP/1.1" 404 - http-bio-8080-exec-2 0

Vulnerable code: 		Statement s = null;
			s = conn.createStatement();
			if (s.execute(sql)) {
				return s.getResultSet();
			} else {
			}
				if (s != null) {
					s.close();
		String query = "SELECT * FROM USER WHERE NAME = '" + name + "'";
		ResultSet users = Database.execute(query);
		String query = "SELECT * FROM USER WHERE NAME = ?";
		ResultSet users = Database.execute(query);
		ArrayList<User> searchedUsers = new ArrayList<User>();
		try {
		} catch (SQLException e) {
<script src="http://code.jquery.com/jquery-2.1.3.js"
	type="text/javascript"></script>
    $.ajax({
        url : 'api/usuarios',
        type : "GET",
    }).done(function(resp) {
        $("#usuarios").html(resp);
    });
    $("#pesquisar").click(function() {
        $.ajax({
            url : 'api/usuarios',
            type : "GET",
            data : {
                name : $("#search").val()
            }
        }).done(function(resp) {
            $("#usuarios").html(resp);
        });
    });
<tbody>
{{~it : client}}
	<td>{{=client.name}}</td>
	<td>{{=client.password}}</td>
	<td>{{=client.creditCardNumber}}</td>
#Fri Feb 06 13:33:32 BRST 2015
<<<<<<< HEAD
=======
com/dextra/injectit/database/MockDatabase.class
>>>>>>> a83373cb29646b4fd9576b44d0ae4a4128cd7637
com/dextra/injectit/booter/ContextListener.class
com/dextra/injectit/servlets/InjectServlet.class
com/dextra/injectit/database/User.class
<<<<<<< HEAD
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
/home/bruno.goncalves/Documentos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
=======
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
/home/vinicius.moreti/projetos/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
>>>>>>> a83373cb29646b4fd9576b44d0ae4a4128cd7637
Fixed code: import java.sql.CallableStatement;
import java.sql.PreparedStatement;
import sun.security.provider.ConfigFile.Spi;

	public static ResultSet executeStoredPrcedure(String spCalled, Object... parameters){
		Connection conn = getConnection();
		CallableStatement cs = null;

		try {
			cs = conn.prepareCall(spCalled);
			if (parameters != null)
				for (int parameterIndex = 0; parameterIndex < parameters.length; ++parameterIndex){
					cs.setObject(parameterIndex + 1, parameters[parameterIndex]);
				}
			System.out.println(cs.toString());
			if (cs.execute())
				return  cs.executeQuery();	
			else 
				return null;
		} catch (SQLException e) {
		
			throw new RuntimeException(e);
		
		} finally {
			try {
				if (cs != null) {
					cs.close();
				}
				conn.close();
			} catch (SQLException e) {
				throw new RuntimeException(e);
			}
		}
	}
	
		PreparedStatement ps = null;
			System.out.println(sql);
			ps = conn.prepareStatement(sql);
			
			// Set the parameters
			if (objects != null)
				for (int parameterIndex = 0; parameterIndex < objects.length; ++parameterIndex){
					ps.setObject(parameterIndex + 1, objects[parameterIndex]);
				}
			
			if (ps.execute())
				return ps.getResultSet();
			else
			
			e.printStackTrace();
				if (ps != null) {
					ps.close();
		
		String sp = "CREATE PROCEDURE sp_getUser "
				+ "(@user VARCHAR(100)) "
				+ "AS "
				+ "BEGIN "
				+ "SELECT * FROM USER WHERE NAME = @user "
				+ "END";
		Database.execute(sp);
import com.dextra.injectit.database.MockDatabase;
		String[] names = new String[1];
		names[0] = name;
		String query = "SELECT * FROM USER WHERE NAME = ?";
		ResultSet users = Database.execute(query,names);
		try {
			MockDatabase.execute();
			
			
			String query = "{call sp_getUser(?)}";
			Object []objs = new Object [1];
			objs[0] = "Jefferson";
			
			ResultSet users = Database.executeStoredPrcedure(query, objs);
			ArrayList<User> searchedUsers = new ArrayList<User>();
		} catch (Exception e) {
	
	<script src="http://code.jquery.com/jquery-2.1.3.js" type="text/javascript"></script>
	<script src="js/index.js" type="text/javascript"></script>
	<script src="js/doT.js" type="text/javascript"></script>
	
$(document).ready(function(){
	$.ajax({
		type : 'GET',
		url : 'api/usuarios',
		dataType : 'json'
	}).success(function(strJson) {
		$.get('templates/template.html').done(function(template) {
			$('#usuarios').html(doT.template(template)(strJson));
		});
	})
});
$('#pesquisar').click(function() {

	$.ajax({
		url : 'api/usuarios',
		type : 'POST',
		data : {
			name : $('#search').val()
		},
		dataType : 'json'
	}).done(function(resp) {
		console.info(resp);
		$.get('templates/template.html',function (template){
			$("#usuarios").html(doT.template(template)(resp));
		}, "html");

	});
});
<tbody> 
{{console.info(it);}}
{{~it :user}}
	{{console.info();}}
	<td>{{=user.name}}</td>
	<td>{{=user.password}}</td>
	<td>{{=user.creditCardNumber}}</td>
#Sun Feb 08 22:05:57 BRST 2015
com/dextra/injectit/database/User.class
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/User.java
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/MockDatabase.java
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/database/Database.java
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/booter/ContextListener.java
/home/bruno/Documents/desafio_buzz_woody/injectIt/src/main/java/com/dextra/injectit/servlets/InjectServlet.java
127.0.0.1 - - [08/Feb/2015:22:34:56 -0200] "GET / HTTP/1.1" 404 - http-bio-8080-exec-1 0
127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt HTTP/1.1" 302 - http-bio-8080-exec-2 0
127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/ HTTP/1.1" 200 582 http-bio-8080-exec-3 215
127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/js/index.js HTTP/1.1" 200 597 http-bio-8080-exec-4 7
127.0.0.1 - - [08/Feb/2015:22:35:05 -0200] "GET /injectIt/js/doT.js HTTP/1.1" 200 5163 http-bio-8080-exec-5 31
127.0.0.1 - - [08/Feb/2015:22:35:06 -0200] "GET /injectIt/api/usuarios HTTP/1.1" 405 1065 http-bio-8080-exec-7 4
127.0.0.1 - - [08/Feb/2015:22:35:10 -0200] "POST /injectIt/api/usuarios HTTP/1.1" 200 12 http-bio-8080-exec-8 58
127.0.0.1 - - [08/Feb/2015:22:35:10 -0200] "GET /injectIt/templates/template.html HTTP/1.1" 200 296 http-bio-8080-exec-9 27
127.0.0.1 - - [08/Feb/2015:22:35:14 -0200] "POST /injectIt/api/usuarios HTTP/1.1" 200 84 http-bio-8080-exec-10 10
127.0.0.1 - - [08/Feb/2015:22:54:04 -0200] "GET /help/topic/com.vmware.ICbase/images/vmware_favicon.ico HTTP/1.1" 404 - http-bio-8080-exec-2 0