You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The below list presents the 10 most relevant findings that need your attention. To view information on the remaining findings, navigate to the Mend SAST Application.
statement.execute("CREATE TABLE PEOPLE (USER_ID VARCHAR(50) NOT NULL, PASSWORD VARCHAR(20) NOT NULL, FIRST_NAME VARCHAR(100) NOT NULL, LAST_NAME VARCHAR(100) NOT NULL, ROLE VARCHAR(50) NOT NULL, PRIMARY KEY (USER_ID))");
statement.execute("CREATE TABLE FEEDBACK (FEEDBACK_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 1022, INCREMENT BY 1), NAME VARCHAR(100) NOT NULL, EMAIL VARCHAR(50) NOT NULL, SUBJECT VARCHAR(100) NOT NULL, COMMENTS VARCHAR(500) NOT NULL, PRIMARY KEY (FEEDBACK_ID))");
statement.execute("CREATE TABLE ACCOUNTS (ACCOUNT_ID BIGINT NOT NULL GENERATED BY DEFAULT AS IDENTITY (START WITH 800000, INCREMENT BY 1), USERID VARCHAR(50) NOT NULL, ACCOUNT_NAME VARCHAR(100) NOT NULL, BALANCE DOUBLE NOT NULL, PRIMARY KEY (ACCOUNT_ID))");
statement.execute("CREATE TABLE TRANSACTIONS (TRANSACTION_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 2311, INCREMENT BY 1), ACCOUNTID BIGINT NOT NULL, DATE TIMESTAMP NOT NULL, TYPE VARCHAR(100) NOT NULL, AMOUNT DOUBLE NOT NULL, PRIMARY KEY (TRANSACTION_ID))");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('admin', 'admin', 'Admin', 'User','admin'), ('jsmith','demo1234', 'John', 'Smith','user'),('jdoe','demo1234', 'Jane', 'Doe','user'),('sspeed','demo1234', 'Sam', 'Speed','user'),('tuser','tuser','Test', 'User','user')");
ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
if (resultSet.next()){
if (resultSet.getInt(1) > 0)
return true;
}
return false;
}
/**
* Get user information
* @param username
* @return user information
* @throws SQLException
*/
public static User getUserInfo(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
String firstName = null;
String lastName = null;
String roleString = null;
if (resultSet.next()){
firstName = resultSet.getString("FIRST_NAME");
lastName = resultSet.getString("LAST_NAME");
roleString = resultSet.getString("ROLE");
}
if (firstName == null || lastName == null)
return null;
User user = new User(username, firstName, lastName);
if (roleString.equalsIgnoreCase("admin"))
user.setRole(Role.Admin);
return user;
}
/**
* Get all accounts for the specified user
* @param username
* @return
* @throws SQLException
*/
public static Account[] getAccounts(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
long accountId = resultSet.getLong("ACCOUNT_ID");
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountId, name, balance);
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountNo, name, balance);
accounts.add(newAccount);
}
if (accounts.size()==0)
return null;
return accounts.get(0);
}
public static String addAccount(String username, String acctType) {
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
return null;
} catch (SQLException e){
return e.toString();
}
}
public static String changePassword(String username, String password) {
statement.execute("CREATE TABLE PEOPLE (USER_ID VARCHAR(50) NOT NULL, PASSWORD VARCHAR(20) NOT NULL, FIRST_NAME VARCHAR(100) NOT NULL, LAST_NAME VARCHAR(100) NOT NULL, ROLE VARCHAR(50) NOT NULL, PRIMARY KEY (USER_ID))");
statement.execute("CREATE TABLE FEEDBACK (FEEDBACK_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 1022, INCREMENT BY 1), NAME VARCHAR(100) NOT NULL, EMAIL VARCHAR(50) NOT NULL, SUBJECT VARCHAR(100) NOT NULL, COMMENTS VARCHAR(500) NOT NULL, PRIMARY KEY (FEEDBACK_ID))");
statement.execute("CREATE TABLE ACCOUNTS (ACCOUNT_ID BIGINT NOT NULL GENERATED BY DEFAULT AS IDENTITY (START WITH 800000, INCREMENT BY 1), USERID VARCHAR(50) NOT NULL, ACCOUNT_NAME VARCHAR(100) NOT NULL, BALANCE DOUBLE NOT NULL, PRIMARY KEY (ACCOUNT_ID))");
statement.execute("CREATE TABLE TRANSACTIONS (TRANSACTION_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 2311, INCREMENT BY 1), ACCOUNTID BIGINT NOT NULL, DATE TIMESTAMP NOT NULL, TYPE VARCHAR(100) NOT NULL, AMOUNT DOUBLE NOT NULL, PRIMARY KEY (TRANSACTION_ID))");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('admin', 'admin', 'Admin', 'User','admin'), ('jsmith','demo1234', 'John', 'Smith','user'),('jdoe','demo1234', 'Jane', 'Doe','user'),('sspeed','demo1234', 'Sam', 'Speed','user'),('tuser','tuser','Test', 'User','user')");
ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
if (resultSet.next()){
if (resultSet.getInt(1) > 0)
return true;
}
return false;
}
/**
* Get user information
* @param username
* @return user information
* @throws SQLException
*/
public static User getUserInfo(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
String firstName = null;
String lastName = null;
String roleString = null;
if (resultSet.next()){
firstName = resultSet.getString("FIRST_NAME");
lastName = resultSet.getString("LAST_NAME");
roleString = resultSet.getString("ROLE");
}
if (firstName == null || lastName == null)
return null;
User user = new User(username, firstName, lastName);
if (roleString.equalsIgnoreCase("admin"))
user.setRole(Role.Admin);
return user;
}
/**
* Get all accounts for the specified user
* @param username
* @return
* @throws SQLException
*/
public static Account[] getAccounts(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
long accountId = resultSet.getLong("ACCOUNT_ID");
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountId, name, balance);
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountNo, name, balance);
accounts.add(newAccount);
}
if (accounts.size()==0)
return null;
return accounts.get(0);
}
public static String addAccount(String username, String acctType) {
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
return null;
} catch (SQLException e){
return e.toString();
}
}
public static String changePassword(String username, String password) {
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
statement.execute("CREATE TABLE PEOPLE (USER_ID VARCHAR(50) NOT NULL, PASSWORD VARCHAR(20) NOT NULL, FIRST_NAME VARCHAR(100) NOT NULL, LAST_NAME VARCHAR(100) NOT NULL, ROLE VARCHAR(50) NOT NULL, PRIMARY KEY (USER_ID))");
statement.execute("CREATE TABLE FEEDBACK (FEEDBACK_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 1022, INCREMENT BY 1), NAME VARCHAR(100) NOT NULL, EMAIL VARCHAR(50) NOT NULL, SUBJECT VARCHAR(100) NOT NULL, COMMENTS VARCHAR(500) NOT NULL, PRIMARY KEY (FEEDBACK_ID))");
statement.execute("CREATE TABLE ACCOUNTS (ACCOUNT_ID BIGINT NOT NULL GENERATED BY DEFAULT AS IDENTITY (START WITH 800000, INCREMENT BY 1), USERID VARCHAR(50) NOT NULL, ACCOUNT_NAME VARCHAR(100) NOT NULL, BALANCE DOUBLE NOT NULL, PRIMARY KEY (ACCOUNT_ID))");
statement.execute("CREATE TABLE TRANSACTIONS (TRANSACTION_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 2311, INCREMENT BY 1), ACCOUNTID BIGINT NOT NULL, DATE TIMESTAMP NOT NULL, TYPE VARCHAR(100) NOT NULL, AMOUNT DOUBLE NOT NULL, PRIMARY KEY (TRANSACTION_ID))");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('admin', 'admin', 'Admin', 'User','admin'), ('jsmith','demo1234', 'John', 'Smith','user'),('jdoe','demo1234', 'Jane', 'Doe','user'),('sspeed','demo1234', 'Sam', 'Speed','user'),('tuser','tuser','Test', 'User','user')");
ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
if (resultSet.next()){
if (resultSet.getInt(1) > 0)
return true;
}
return false;
}
/**
* Get user information
* @param username
* @return user information
* @throws SQLException
*/
public static User getUserInfo(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
String firstName = null;
String lastName = null;
String roleString = null;
if (resultSet.next()){
firstName = resultSet.getString("FIRST_NAME");
lastName = resultSet.getString("LAST_NAME");
roleString = resultSet.getString("ROLE");
}
if (firstName == null || lastName == null)
return null;
User user = new User(username, firstName, lastName);
if (roleString.equalsIgnoreCase("admin"))
user.setRole(Role.Admin);
return user;
}
/**
* Get all accounts for the specified user
* @param username
* @return
* @throws SQLException
*/
public static Account[] getAccounts(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
long accountId = resultSet.getLong("ACCOUNT_ID");
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountId, name, balance);
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountNo, name, balance);
accounts.add(newAccount);
}
if (accounts.size()==0)
return null;
return accounts.get(0);
}
public static String addAccount(String username, String acctType) {
- statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
+ PreparedStatement statement = connection
+ .prepareStatement("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"
statement.execute("CREATE TABLE PEOPLE (USER_ID VARCHAR(50) NOT NULL, PASSWORD VARCHAR(20) NOT NULL, FIRST_NAME VARCHAR(100) NOT NULL, LAST_NAME VARCHAR(100) NOT NULL, ROLE VARCHAR(50) NOT NULL, PRIMARY KEY (USER_ID))");
statement.execute("CREATE TABLE FEEDBACK (FEEDBACK_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 1022, INCREMENT BY 1), NAME VARCHAR(100) NOT NULL, EMAIL VARCHAR(50) NOT NULL, SUBJECT VARCHAR(100) NOT NULL, COMMENTS VARCHAR(500) NOT NULL, PRIMARY KEY (FEEDBACK_ID))");
statement.execute("CREATE TABLE ACCOUNTS (ACCOUNT_ID BIGINT NOT NULL GENERATED BY DEFAULT AS IDENTITY (START WITH 800000, INCREMENT BY 1), USERID VARCHAR(50) NOT NULL, ACCOUNT_NAME VARCHAR(100) NOT NULL, BALANCE DOUBLE NOT NULL, PRIMARY KEY (ACCOUNT_ID))");
statement.execute("CREATE TABLE TRANSACTIONS (TRANSACTION_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 2311, INCREMENT BY 1), ACCOUNTID BIGINT NOT NULL, DATE TIMESTAMP NOT NULL, TYPE VARCHAR(100) NOT NULL, AMOUNT DOUBLE NOT NULL, PRIMARY KEY (TRANSACTION_ID))");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('admin', 'admin', 'Admin', 'User','admin'), ('jsmith','demo1234', 'John', 'Smith','user'),('jdoe','demo1234', 'Jane', 'Doe','user'),('sspeed','demo1234', 'Sam', 'Speed','user'),('tuser','tuser','Test', 'User','user')");
ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
if (resultSet.next()){
if (resultSet.getInt(1) > 0)
return true;
}
return false;
}
/**
* Get user information
* @param username
* @return user information
* @throws SQLException
*/
public static User getUserInfo(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
String firstName = null;
String lastName = null;
String roleString = null;
if (resultSet.next()){
firstName = resultSet.getString("FIRST_NAME");
lastName = resultSet.getString("LAST_NAME");
roleString = resultSet.getString("ROLE");
}
if (firstName == null || lastName == null)
return null;
User user = new User(username, firstName, lastName);
if (roleString.equalsIgnoreCase("admin"))
user.setRole(Role.Admin);
return user;
}
/**
* Get all accounts for the specified user
* @param username
* @return
* @throws SQLException
*/
public static Account[] getAccounts(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
long accountId = resultSet.getLong("ACCOUNT_ID");
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountId, name, balance);
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountNo, name, balance);
accounts.add(newAccount);
}
if (accounts.size()==0)
return null;
return accounts.get(0);
}
public static String addAccount(String username, String acctType) {
- statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
+ PreparedStatement statement = connection
+ .prepareStatement("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES (" + "?"
ResultSetresultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
statement.execute("CREATE TABLE PEOPLE (USER_ID VARCHAR(50) NOT NULL, PASSWORD VARCHAR(20) NOT NULL, FIRST_NAME VARCHAR(100) NOT NULL, LAST_NAME VARCHAR(100) NOT NULL, ROLE VARCHAR(50) NOT NULL, PRIMARY KEY (USER_ID))");
statement.execute("CREATE TABLE FEEDBACK (FEEDBACK_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 1022, INCREMENT BY 1), NAME VARCHAR(100) NOT NULL, EMAIL VARCHAR(50) NOT NULL, SUBJECT VARCHAR(100) NOT NULL, COMMENTS VARCHAR(500) NOT NULL, PRIMARY KEY (FEEDBACK_ID))");
statement.execute("CREATE TABLE ACCOUNTS (ACCOUNT_ID BIGINT NOT NULL GENERATED BY DEFAULT AS IDENTITY (START WITH 800000, INCREMENT BY 1), USERID VARCHAR(50) NOT NULL, ACCOUNT_NAME VARCHAR(100) NOT NULL, BALANCE DOUBLE NOT NULL, PRIMARY KEY (ACCOUNT_ID))");
statement.execute("CREATE TABLE TRANSACTIONS (TRANSACTION_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 2311, INCREMENT BY 1), ACCOUNTID BIGINT NOT NULL, DATE TIMESTAMP NOT NULL, TYPE VARCHAR(100) NOT NULL, AMOUNT DOUBLE NOT NULL, PRIMARY KEY (TRANSACTION_ID))");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('admin', 'admin', 'Admin', 'User','admin'), ('jsmith','demo1234', 'John', 'Smith','user'),('jdoe','demo1234', 'Jane', 'Doe','user'),('sspeed','demo1234', 'Sam', 'Speed','user'),('tuser','tuser','Test', 'User','user')");
ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
if (resultSet.next()){
if (resultSet.getInt(1) > 0)
return true;
}
return false;
}
/**
* Get user information
* @param username
* @return user information
* @throws SQLException
*/
public static User getUserInfo(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
- ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
+ PreparedStatement statement = connection
+ .prepareStatement("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = " + "?");
+ statement.setString(1, username);
+ ResultSet resultSet =statement.executeQuery(); /* BAD - user input should always be sanitized */
String firstName = null;
String lastName = null;
String roleString = null;
if (resultSet.next()){
firstName = resultSet.getString("FIRST_NAME");
lastName = resultSet.getString("LAST_NAME");
roleString = resultSet.getString("ROLE");
}
if (firstName == null || lastName == null)
return null;
User user = new User(username, firstName, lastName);
if (roleString.equalsIgnoreCase("admin"))
user.setRole(Role.Admin);
return user;
}
/**
* Get all accounts for the specified user
* @param username
* @return
* @throws SQLException
*/
public static Account[] getAccounts(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
long accountId = resultSet.getLong("ACCOUNT_ID");
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountId, name, balance);
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountNo, name, balance);
accounts.add(newAccount);
}
if (accounts.size()==0)
return null;
return accounts.get(0);
}
public static String addAccount(String username, String acctType) {
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
return null;
} catch (SQLException e){
return e.toString();
}
}
public static String changePassword(String username, String password) {
statement.execute("CREATE TABLE PEOPLE (USER_ID VARCHAR(50) NOT NULL, PASSWORD VARCHAR(20) NOT NULL, FIRST_NAME VARCHAR(100) NOT NULL, LAST_NAME VARCHAR(100) NOT NULL, ROLE VARCHAR(50) NOT NULL, PRIMARY KEY (USER_ID))");
statement.execute("CREATE TABLE FEEDBACK (FEEDBACK_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 1022, INCREMENT BY 1), NAME VARCHAR(100) NOT NULL, EMAIL VARCHAR(50) NOT NULL, SUBJECT VARCHAR(100) NOT NULL, COMMENTS VARCHAR(500) NOT NULL, PRIMARY KEY (FEEDBACK_ID))");
statement.execute("CREATE TABLE ACCOUNTS (ACCOUNT_ID BIGINT NOT NULL GENERATED BY DEFAULT AS IDENTITY (START WITH 800000, INCREMENT BY 1), USERID VARCHAR(50) NOT NULL, ACCOUNT_NAME VARCHAR(100) NOT NULL, BALANCE DOUBLE NOT NULL, PRIMARY KEY (ACCOUNT_ID))");
statement.execute("CREATE TABLE TRANSACTIONS (TRANSACTION_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 2311, INCREMENT BY 1), ACCOUNTID BIGINT NOT NULL, DATE TIMESTAMP NOT NULL, TYPE VARCHAR(100) NOT NULL, AMOUNT DOUBLE NOT NULL, PRIMARY KEY (TRANSACTION_ID))");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('admin', 'admin', 'Admin', 'User','admin'), ('jsmith','demo1234', 'John', 'Smith','user'),('jdoe','demo1234', 'Jane', 'Doe','user'),('sspeed','demo1234', 'Sam', 'Speed','user'),('tuser','tuser','Test', 'User','user')");
ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
if (resultSet.next()){
if (resultSet.getInt(1) > 0)
return true;
}
return false;
}
/**
* Get user information
* @param username
* @return user information
* @throws SQLException
*/
public static User getUserInfo(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
String firstName = null;
String lastName = null;
String roleString = null;
if (resultSet.next()){
firstName = resultSet.getString("FIRST_NAME");
lastName = resultSet.getString("LAST_NAME");
roleString = resultSet.getString("ROLE");
}
if (firstName == null || lastName == null)
return null;
User user = new User(username, firstName, lastName);
if (roleString.equalsIgnoreCase("admin"))
user.setRole(Role.Admin);
return user;
}
/**
* Get all accounts for the specified user
* @param username
* @return
* @throws SQLException
*/
public static Account[] getAccounts(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
long accountId = resultSet.getLong("ACCOUNT_ID");
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountId, name, balance);
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountNo, name, balance);
accounts.add(newAccount);
}
if (accounts.size()==0)
return null;
return accounts.get(0);
}
public static String addAccount(String username, String acctType) {
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
return null;
} catch (SQLException e){
return e.toString();
}
}
public static String changePassword(String username, String password) {
statement.execute("CREATE TABLE PEOPLE (USER_ID VARCHAR(50) NOT NULL, PASSWORD VARCHAR(20) NOT NULL, FIRST_NAME VARCHAR(100) NOT NULL, LAST_NAME VARCHAR(100) NOT NULL, ROLE VARCHAR(50) NOT NULL, PRIMARY KEY (USER_ID))");
statement.execute("CREATE TABLE FEEDBACK (FEEDBACK_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 1022, INCREMENT BY 1), NAME VARCHAR(100) NOT NULL, EMAIL VARCHAR(50) NOT NULL, SUBJECT VARCHAR(100) NOT NULL, COMMENTS VARCHAR(500) NOT NULL, PRIMARY KEY (FEEDBACK_ID))");
statement.execute("CREATE TABLE ACCOUNTS (ACCOUNT_ID BIGINT NOT NULL GENERATED BY DEFAULT AS IDENTITY (START WITH 800000, INCREMENT BY 1), USERID VARCHAR(50) NOT NULL, ACCOUNT_NAME VARCHAR(100) NOT NULL, BALANCE DOUBLE NOT NULL, PRIMARY KEY (ACCOUNT_ID))");
statement.execute("CREATE TABLE TRANSACTIONS (TRANSACTION_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 2311, INCREMENT BY 1), ACCOUNTID BIGINT NOT NULL, DATE TIMESTAMP NOT NULL, TYPE VARCHAR(100) NOT NULL, AMOUNT DOUBLE NOT NULL, PRIMARY KEY (TRANSACTION_ID))");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('admin', 'admin', 'Admin', 'User','admin'), ('jsmith','demo1234', 'John', 'Smith','user'),('jdoe','demo1234', 'Jane', 'Doe','user'),('sspeed','demo1234', 'Sam', 'Speed','user'),('tuser','tuser','Test', 'User','user')");
ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
if (resultSet.next()){
if (resultSet.getInt(1) > 0)
return true;
}
return false;
}
/**
* Get user information
* @param username
* @return user information
* @throws SQLException
*/
public static User getUserInfo(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
String firstName = null;
String lastName = null;
String roleString = null;
if (resultSet.next()){
firstName = resultSet.getString("FIRST_NAME");
lastName = resultSet.getString("LAST_NAME");
roleString = resultSet.getString("ROLE");
}
if (firstName == null || lastName == null)
return null;
User user = new User(username, firstName, lastName);
if (roleString.equalsIgnoreCase("admin"))
user.setRole(Role.Admin);
return user;
}
/**
* Get all accounts for the specified user
* @param username
* @return
* @throws SQLException
*/
public static Account[] getAccounts(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
long accountId = resultSet.getLong("ACCOUNT_ID");
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountId, name, balance);
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountNo, name, balance);
accounts.add(newAccount);
}
if (accounts.size()==0)
return null;
return accounts.get(0);
}
public static String addAccount(String username, String acctType) {
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
return null;
} catch (SQLException e){
return e.toString();
}
}
public static String changePassword(String username, String password) {
ResultSetresultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
statement.execute("CREATE TABLE PEOPLE (USER_ID VARCHAR(50) NOT NULL, PASSWORD VARCHAR(20) NOT NULL, FIRST_NAME VARCHAR(100) NOT NULL, LAST_NAME VARCHAR(100) NOT NULL, ROLE VARCHAR(50) NOT NULL, PRIMARY KEY (USER_ID))");
statement.execute("CREATE TABLE FEEDBACK (FEEDBACK_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 1022, INCREMENT BY 1), NAME VARCHAR(100) NOT NULL, EMAIL VARCHAR(50) NOT NULL, SUBJECT VARCHAR(100) NOT NULL, COMMENTS VARCHAR(500) NOT NULL, PRIMARY KEY (FEEDBACK_ID))");
statement.execute("CREATE TABLE ACCOUNTS (ACCOUNT_ID BIGINT NOT NULL GENERATED BY DEFAULT AS IDENTITY (START WITH 800000, INCREMENT BY 1), USERID VARCHAR(50) NOT NULL, ACCOUNT_NAME VARCHAR(100) NOT NULL, BALANCE DOUBLE NOT NULL, PRIMARY KEY (ACCOUNT_ID))");
statement.execute("CREATE TABLE TRANSACTIONS (TRANSACTION_ID INTEGER NOT NULL GENERATED ALWAYS AS IDENTITY (START WITH 2311, INCREMENT BY 1), ACCOUNTID BIGINT NOT NULL, DATE TIMESTAMP NOT NULL, TYPE VARCHAR(100) NOT NULL, AMOUNT DOUBLE NOT NULL, PRIMARY KEY (TRANSACTION_ID))");
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('admin', 'admin', 'Admin', 'User','admin'), ('jsmith','demo1234', 'John', 'Smith','user'),('jdoe','demo1234', 'Jane', 'Doe','user'),('sspeed','demo1234', 'Sam', 'Speed','user'),('tuser','tuser','Test', 'User','user')");
+ .prepareStatement("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '" + user + "' AND PASSWORD=" + "?");
+ statement.setString(1, password);
+ ResultSet resultSet =statement.executeQuery(); /* BAD - user input should always be sanitized */
@@ -219,2 +223,0 @@
- ResultSet resultSet =statement.executeQuery("SELECT COUNT(*)FROM PEOPLE WHERE USER_ID = '"+ user +"' AND PASSWORD='" + password + "'"); /* BAD - user input should always be sanitized */
-
if (resultSet.next()){
if (resultSet.getInt(1) > 0)
return true;
}
return false;
}
/**
* Get user information
* @param username
* @return user information
* @throws SQLException
*/
public static User getUserInfo(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT FIRST_NAME,LAST_NAME,ROLE FROM PEOPLE WHERE USER_ID = '"+ username +"' "); /* BAD - user input should always be sanitized */
String firstName = null;
String lastName = null;
String roleString = null;
if (resultSet.next()){
firstName = resultSet.getString("FIRST_NAME");
lastName = resultSet.getString("LAST_NAME");
roleString = resultSet.getString("ROLE");
}
if (firstName == null || lastName == null)
return null;
User user = new User(username, firstName, lastName);
if (roleString.equalsIgnoreCase("admin"))
user.setRole(Role.Admin);
return user;
}
/**
* Get all accounts for the specified user
* @param username
* @return
* @throws SQLException
*/
public static Account[] getAccounts(String username) throws SQLException{
if (username == null || username.trim().length() == 0)
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
long accountId = resultSet.getLong("ACCOUNT_ID");
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountId, name, balance);
ResultSet resultSet =statement.executeQuery("SELECT ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE ACCOUNT_ID = "+ accountNo +" "); /* BAD - user input should always be sanitized */
ArrayList<Account> accounts = new ArrayList<Account>(3);
while (resultSet.next()){
String name = resultSet.getString("ACCOUNT_NAME");
double balance = resultSet.getDouble("BALANCE");
Account newAccount = new Account(accountNo, name, balance);
accounts.add(newAccount);
}
if (accounts.size()==0)
return null;
return accounts.get(0);
}
public static String addAccount(String username, String acctType) {
statement.execute("INSERT INTO PEOPLE (USER_ID,PASSWORD,FIRST_NAME,LAST_NAME,ROLE) VALUES ('"+username+"','"+password+"', '"+firstname+"', '"+lastname+"','user')");
return null;
} catch (SQLException e){
return e.toString();
}
}
public static String changePassword(String username, String password) {
ResultSetresultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
ResultSetresultSet =statement.executeQuery("SELECT ACCOUNT_ID, ACCOUNT_NAME, BALANCE FROM ACCOUNTS WHERE USERID = '"+ username +"' "); /* BAD - user input should always be sanitized */
mend-for-github-combot
changed the title
Code Security Report: 31 high severity findings, 67 total findings
Code Security Report: 24 high severity findings, 41 total findings
Nov 21, 2023
Code Security Report
Scan Metadata
Latest Scan: 2023-11-21 12:44pm
Total Findings: 41 | New Findings: 0 | Resolved Findings: 2
Tested Project Files: 135
Detected Programming Languages: 2 (JavaScript / Node.js, Java*)
Most Relevant Findings
Automatic Remediation Available (6)
CWE-89
DBUtil.java:506
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Lines 501 to 506 in eb96a35
2 Data Flow/s detected
View Data Flow 1
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
Line 91 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
Line 103 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 502 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 506 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 506 in eb96a35
View Data Flow 2
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 22 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 32 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 32 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 35 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 35 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 35 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 35 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 56 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 502 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 506 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 506 in eb96a35
⛑️ Remediation Suggestion
AltoroJ/diffs/18500e04-1e34-49e2-a57a-cd06821123bd/DBUtil.java.diff
Lines 1 to 541 in 6877891
AltoroJ/diffs/b5e1b64e-21b8-482d-bff2-623d505c1d58/DBUtil.java.diff
Lines 1 to 541 in 2318900
CWE-89
DBUtil.java:494
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Lines 489 to 494 in eb96a35
2 Data Flow/s detected
View Data Flow 1
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
Line 59 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
Line 80 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 490 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 494 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 494 in eb96a35
View Data Flow 2
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 67 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 80 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 80 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 83 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 83 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 83 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 83 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AdminAPI.java
Line 103 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 490 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 494 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 494 in eb96a35
⛑️ Remediation Suggestion
AltoroJ/diffs/d13231ca-d653-4da4-8b9c-618317813671/DBUtil.java.diff
Lines 1 to 542 in e14a803
AltoroJ/diffs/19f7e4c2-78e3-4818-964c-123fc8c2cd23/DBUtil.java.diff
Lines 1 to 542 in 6d71b31
CWE-89
DBUtil.java:242
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Lines 237 to 242 in eb96a35
2 Data Flow/s detected
View Data Flow 1
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 75 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 94 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
Line 340 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
Line 342 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 236 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 242 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 242 in eb96a35
View Data Flow 2
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 136 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 136 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 136 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 139 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 139 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 139 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 139 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 140 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 140 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 142 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 236 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 242 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 242 in eb96a35
⛑️ Remediation Suggestion
AltoroJ/diffs/c777a8b5-5b0f-4a2a-bc95-4d28bdb746ff/DBUtil.java.diff
Lines 1 to 541 in 98b5f78
CWE-89
DBUtil.java:519
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Lines 514 to 519 in eb96a35
1 Data Flow/s detected
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/FeedbackServlet.java
Line 49 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/FeedbackServlet.java
Line 57 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 119 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 127 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 515 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 519 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 519 in eb96a35
⛑️ Remediation Suggestion
AltoroJ/diffs/2c3bddf1-1afc-4716-81a9-bf89aa79b622/DBUtil.java.diff
Lines 1 to 542 in 32e893c
CWE-89
DBUtil.java:471
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Lines 466 to 471 in eb96a35
1 Data Flow/s detected
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
Line 44 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/AdminServlet.java
Line 49 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 467 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 471 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 471 in eb96a35
⛑️ Remediation Suggestion
AltoroJ/diffs/1a910b2b-0a1f-4d44-b0fc-f408ee5e5b7d/DBUtil.java.diff
Lines 1 to 541 in bbc088b
CWE-89
DBUtil.java:219
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Lines 214 to 219 in eb96a35
3 Data Flow/s detected
View Data Flow 1
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/CCApplyServlet.java
Line 47 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/CCApplyServlet.java
Line 51 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/CCApplyServlet.java
Line 51 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/CCApplyServlet.java
Line 51 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 212 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 219 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 219 in eb96a35
View Data Flow 2
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 79 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 80 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 80 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 80 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 80 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 82 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 212 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 219 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 219 in eb96a35
View Data Flow 3
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 31 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 35 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 35 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 52 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 52 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 52 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 52 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 52 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 52 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/LoginAPI.java
Line 57 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 212 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 219 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 219 in eb96a35
⛑️ Remediation Suggestion
AltoroJ/diffs/c17e70f0-145b-455a-a3e4-8b137cdfe790/DBUtil.java.diff
Lines 1 to 542 in d0dd576
No Automatic Remediation (4)
CWE-78
index.jsp:65
AltoroJ/WebContent/index.jsp
Lines 60 to 65 in eb96a35
2 Data Flow/s detected
View Data Flow 1
AltoroJ/WebContent/index.jsp
Line 38 in eb96a35
AltoroJ/WebContent/index.jsp
Line 62 in eb96a35
AltoroJ/WebContent/index.jsp
Line 65 in eb96a35
AltoroJ/WebContent/index.jsp
Line 65 in eb96a35
View Data Flow 2
AltoroJ/WebContent/index.jsp
Line 38 in eb96a35
AltoroJ/WebContent/index.jsp
Line 62 in eb96a35
AltoroJ/WebContent/index.jsp
Line 65 in eb96a35
AltoroJ/WebContent/index.jsp
Line 65 in eb96a35
CWE-94
serverStatusCheck.html:41
AltoroJ/WebContent/util/serverStatusCheck.html
Lines 36 to 41 in eb96a35
1 Data Flow/s detected
AltoroJ/WebContent/util/serverStatusCheck.html
Line 41 in eb96a35
CWE-89
DBUtil.java:276
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Lines 271 to 276 in eb96a35
2 Data Flow/s detected
View Data Flow 1
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 75 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/servlet/LoginServlet.java
Line 94 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
Line 340 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
Line 342 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 236 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 256 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 41 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 42 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 256 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
Line 342 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/ServletUtil.java
Line 343 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 76 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 78 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 270 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 276 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 276 in eb96a35
View Data Flow 2
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 136 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 136 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 136 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 139 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 139 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 139 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 139 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 140 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 140 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 141 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 142 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 236 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 256 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 41 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 42 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 256 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/OperationsUtil.java
Line 142 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AccountAPI.java
Line 35 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/api/AccountAPI.java
Line 35 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 76 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 78 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 270 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 276 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 276 in eb96a35
CWE-89
DBUtil.java:403
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Lines 398 to 403 in eb96a35
1 Data Flow/s detected
AltoroJ/WebContent/bank/transaction.jsp
Line 41 in eb96a35
AltoroJ/WebContent/bank/transaction.jsp
Line 47 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 101 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/model/User.java
Line 104 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 370 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 396 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 399 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 399 in eb96a35
AltoroJ/src/com/ibm/security/appscan/altoromutual/util/DBUtil.java
Line 403 in eb96a35
Findings Overview
The text was updated successfully, but these errors were encountered: