Page History

...

Code Block

bgColor	#ccccff

  public void doPrivilegedAction(
    String username, char[] password
  ) throws SQLException {
    Connection connection = getConnection();
    if (connection == null) {
      // Handle error
    }
    try {
      String pwd = hashPassword(password);

      // Ensure that the length of user name is legitimate
      if ((username.length() > 8) {
        // Handle error
      }

      String sqlString = 
        "select * from db_user where username=? and password=?";
      PreparedStatement stmt = connection.prepareStatement(sqlString);
      stmt.setString(1, username);
      stmt.setString(2, pwd);
      ResultSet rs = stmt.executeQuery();
      if (!rs.next()) {
        throw new SecurityException("User name or password incorrect");
      }

      // Authenticated, proceed
    } finally {
      try {
        connection.close();
      } catch (SQLException x) {
        // forward to handler
      }
    }
  }

...

CERT C Secure Coding Standard	STR02-C. Sanitize data passed to complex subsystems
CERT C++ Secure Coding Standard	STR02-CPP. Sanitize data passed to complex subsystems
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="d066e887a7f6c997-36bf48c4-4b60411e-8e599a89-f061ac53aef8138be274ef05"><ac:plain-text-body><![CDATA[	[ISO/IEC TR 24772:2010	http://www.aitcnet.org/isai/]	Injection [RST]	]]></ac:plain-text-body></ac:structured-macro>
MITRE CWE	CWE-116. Improper encoding or escaping of output

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a1b454bf128b8aef-16045d95-498943ce-b0a6be0e-b0dc953733d28f90a7ff5d11"><ac:plain-text-body><![CDATA[	[[OWASP 2005	AA. References#OWASP 05]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="5c2b40eb9426f135-61713314-42ae4203-9cff9a60-3b5eef05b77e380a87ce1c99"><ac:plain-text-body><![CDATA[	[[OWASP 2007	AA. References#OWASP 07]]		]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="43f07dd6e5fde690-5ab8b2be-4b7244b4-b794aeb9-9d22f76109e82a102cfc8e55"><ac:plain-text-body><![CDATA[	[[OWASP 2008	AA. References#OWASP 08]]	[Testing for XML Injection (OWASP-DV-008)	https://www.owasp.org/index.php/Testing_for_XML_Injection_%28OWASP-DV-008%29]	]]></ac:plain-text-body></ac:structured-macro>
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="0c4c94afcb46cdb5-15b419c6-48e44386-90d490e4-895bab1456b06c959f4d6b79"><ac:plain-text-body><![CDATA[	[[W3C 2008	AA. References#W3C 08]]	4.4.3, Included If Validating	]]></ac:plain-text-body></ac:structured-macro>

...

Space shortcuts

Page tree

Versions Compared

Old Version 114

New Version 115

Key