CVE-2014-125052 (Java, published 2023-01-06T21:15Z)
Description: value: A vulnerability was found in JervenBolleman sparql-identifiers and classified as critical. This issue affects some unknown processing of the file src/main/java/org/identifiers/db/RegistryDao.java. The manipulation leads to sql injection. The patch is named 44bb0db91c064e305b192fc73521d1dfd25bde52. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217571.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-89 \u2014 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.
Repository: https://github.com/JervenBolleman/sparql-identifiers
Files changed:
src/main/java/org/identifiers/db/DbUtilities.java
src/main/java/org/identifiers/db/RegistryDao.java
Commit message: Clean up DB code, remove some SQL injection holes.

Vulnerable code:
	public static void closeDbConnection(Connection connection, PreparedStatement stmt)
            if (null !=  stmt)
            {
            	//System.out.println("- Closes the prepared statement");
            	stmt.close();
            }


public class RegistryDao
{
	private Connection connection = null;
	
	
	
	
	public List<URIextended> getSameAsURIs(String uri)
	{
        Boolean error = false;   // if an error happens
        PreparedStatement stmt = null;
        ResultSet rs;
        List<URIextended> urls = null;
        
        // initialisation of the database connection
	    connection = DbUtilities.initDbConnection();
        
        try
        {
            final String uriTobe = uri.substring(0,uri.indexOf("/", 10));
			String query = "SELECT convertPrefix, ptr_datatype FROM mir_resource WHERE `convertPrefix` LIKE '"+uriTobe+"%'";
            
            try
            {
                stmt = connection.prepareStatement(query);
            }
            catch (SQLException e)
            {
                System.err.println("Error while creating the prepared statement!");
                System.err.println("SQL Exception raised: " + e.getMessage());
            }
            
            //logger.debug("SQL prepared query: " + stmt.toString());
            rs = stmt.executeQuery();
            String dataTypeId = null;
            String identifier = null;
            while (rs.next()) {
                String convertPrefix = rs.getString("convertPrefix");
                if(uri.contains(convertPrefix)){
                    dataTypeId = rs.getString("ptr_datatype");
                    identifier = uri.substring(convertPrefix.length());
                }
            }
            query = "SELECT convertPrefix, obsolete FROM mir_resource WHERE ptr_datatype=\""+dataTypeId+"\" and urischeme=1";
            try
            {
                stmt = connection.prepareStatement(query);
            }
            catch (SQLException e)
            {
                System.err.println("Error while creating the prepared statement!");
                System.err.println("SQL Exception raised: " + e.getMessage());
            }
            //logger.debug("SQL prepared query: " + stmt.toString());
            rs = stmt.executeQuery();
            urls = new ArrayList<URIextended>();
            while (rs.next())
            {
                urls.add(new URIextended(rs.getString("convertPrefix") + identifier, rs.getInt("obsolete")));
            }
            rs.close();
        }
        catch (SQLException e)
        {
            //logger.error("Error during the processing of the result of a query.");
            //logger.error("SQL Exception raised: " + e.getMessage());
            error = true;
        }
        finally
        {
        	// closes the database connection and statement
            DbUtilities.closeDbConnection(connection, stmt);
        }
        // exception handling
        if (error)
        {
            throw new RuntimeException("Sorry, an error occurred while dealing with your request.");
        }
        System.out.println("u"+urls.size());
        return urls;

Fixed code:
	public static void closeDbConnection(Connection connection)
public class RegistryDao {

	 * 
	public List<URIextended> getSameAsURIs(String uri) {

		List<URIextended> urls = null;
		// initialisation of the database connection
		try (Connection connection = DbUtilities.initDbConnection()) {
			final String uriTobe = uri.substring(0, uri.indexOf("/", 10))+'%';
			String query = "SELECT convertPrefix, ptr_datatype FROM mir_resource WHERE `convertPrefix` LIKE ?";
			String dataTypeId = null;
			String identifier = null;
			try (PreparedStatement stmt = connection.prepareStatement(query)) {
				stmt.setString(1, uriTobe);
				try (ResultSet rs = stmt.executeQuery()) {
					while (rs.next()) {
						String convertPrefix = rs.getString("convertPrefix");
						if (uri.contains(convertPrefix)) {
							dataTypeId = rs.getString("ptr_datatype");
							identifier = uri.substring(convertPrefix.length());
						}
					}
				}
			} catch (SQLException e) {
				System.err
						.println("Error while creating the prepared statement!");
				System.err.println("SQL Exception raised: " + e.getMessage());
				throw new RuntimeException(
						"Sorry, an error occurred while dealing with your request.",
						e);
			}
			// logger.debug("SQL prepared query: " + stmt.toString());
			query = "SELECT convertPrefix, obsolete FROM mir_resource WHERE ptr_datatype=? and urischeme=1";
			try (PreparedStatement stmt = connection.prepareStatement(query)) {
				stmt.setString(1, dataTypeId);
				try (ResultSet rs = stmt.executeQuery()) {
					urls = new ArrayList<URIextended>();
					while (rs.next()) {
						urls.add(new URIextended(rs.getString("convertPrefix")
								+ identifier, rs.getInt("obsolete")));
					}
				}
			} catch (SQLException e) {
				System.err
						.println("Error while creating the prepared statement!");
				System.err.println("SQL Exception raised: " + e.getMessage());
				throw new RuntimeException(
						"Sorry, an error occurred while dealing with your request.",
						e);
			}
			// logger.debug("SQL prepared query: " + stmt.toString());
		} catch (SQLException e1) {
			throw new RuntimeException(
					"Sorry, an error occurred while dealing with your request.",
					e1);
		}
		System.out.println("u" + urls.size());
		return urls;