-
Type:
Enhancement
-
Status:
Closed
-
Priority:
Critical
-
Resolution:
Unresolved
-
Component/s:
None
-
-
Module:
BenAdmin
- Security
-
-
Item State:
Development
- Ready for Local Testing
-
Issue Importance:
Must Have
When we add input on notes category like asdf' or '1'='1 , category is getting added successfully.
We should block use of OR with '. it should show sql injection character message.
{"report":{"apdex":1,"isInitial":true,"journeyId":"092eb416-cb30-4bee-ad1b-8ea643bfe992","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":825.4000000003725,"redirectCount":0,"resourceLoadedEnd":837.2999999998137,"resourceLoadedStart":135.70000000018626,"resourceTiming":[{"duration":187.29999999981374,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":135.70000000018626,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":135.70000000018626,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":323,"responseStart":0,"secureConnectionStart":0},{"duration":187.40000000037253,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":136,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":136,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":323.40000000037253,"responseStart":0,"secureConnectionStart":0},{"duration":187.5,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":136,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":136,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":323.5,"responseStart":0,"secureConnectionStart":0},{"duration":187.59999999962747,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":136.20000000018626,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":136.20000000018626,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":323.79999999981374,"responseStart":0,"secureConnectionStart":0},{"duration":187,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":136.79999999981374,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":136.79999999981374,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":323.79999999981374,"responseStart":0,"secureConnectionStart":0},{"duration":205.20000000018626,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":137,"connectEnd":137,"connectStart":137,"domainLookupEnd":137,"domainLookupStart":137,"fetchStart":137,"redirectEnd":0,"redirectStart":0,"requestStart":137,"responseEnd":342.20000000018626,"responseStart":342.20000000018626,"secureConnectionStart":137},{"duration":262.29999999981374,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":137,"connectEnd":137,"connectStart":137,"domainLookupEnd":137,"domainLookupStart":137,"fetchStart":137,"redirectEnd":0,"redirectStart":0,"requestStart":137,"responseEnd":399.29999999981374,"responseStart":399.29999999981374,"secureConnectionStart":137},{"duration":264.70000000018626,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":137.20000000018626,"connectEnd":137.20000000018626,"connectStart":137.20000000018626,"domainLookupEnd":137.20000000018626,"domainLookupStart":137.20000000018626,"fetchStart":137.20000000018626,"redirectEnd":0,"redirectStart":0,"requestStart":137.20000000018626,"responseEnd":401.90000000037253,"responseStart":401.90000000037253,"secureConnectionStart":137.20000000018626},{"duration":265.3999999994412,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":137.20000000018626,"connectEnd":137.20000000018626,"connectStart":137.20000000018626,"domainLookupEnd":137.20000000018626,"domainLookupStart":137.20000000018626,"fetchStart":137.20000000018626,"redirectEnd":0,"redirectStart":0,"requestStart":137.20000000018626,"responseEnd":402.59999999962747,"responseStart":402.5,"secureConnectionStart":137.20000000018626},{"duration":265.59999999962747,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":137.40000000037253,"connectEnd":137.40000000037253,"connectStart":137.40000000037253,"domainLookupEnd":137.40000000037253,"domainLookupStart":137.40000000037253,"fetchStart":137.40000000037253,"redirectEnd":0,"redirectStart":0,"requestStart":137.40000000037253,"responseEnd":403,"responseStart":403,"secureConnectionStart":137.40000000037253},{"duration":266.29999999981374,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":137.5,"connectEnd":137.5,"connectStart":137.5,"domainLookupEnd":137.5,"domainLookupStart":137.5,"fetchStart":137.5,"redirectEnd":0,"redirectStart":0,"requestStart":137.5,"responseEnd":403.79999999981374,"responseStart":403.79999999981374,"secureConnectionStart":137.5},{"duration":266.70000000018626,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":137.5,"connectEnd":137.5,"connectStart":137.5,"domainLookupEnd":137.5,"domainLookupStart":137.5,"fetchStart":137.5,"redirectEnd":0,"redirectStart":0,"requestStart":137.5,"responseEnd":404.20000000018626,"responseStart":404.20000000018626,"secureConnectionStart":137.5},{"duration":271.90000000037253,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":137.59999999962747,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":137.59999999962747,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":409.5,"responseStart":0,"secureConnectionStart":0},{"duration":271.8999999994412,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":137.70000000018626,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":137.70000000018626,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":409.59999999962747,"responseStart":0,"secureConnectionStart":0},{"duration":267.20000000018626,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/ea6f30d2bfdc99578bb23f4a5bac3ecd/shortcuts.js?context=issuenavigation&context=issueaction","startTime":137.70000000018626,"connectEnd":137.70000000018626,"connectStart":137.70000000018626,"domainLookupEnd":137.70000000018626,"domainLookupStart":137.70000000018626,"fetchStart":137.70000000018626,"redirectEnd":0,"redirectStart":0,"requestStart":137.70000000018626,"responseEnd":404.90000000037253,"responseStart":404.90000000037253,"secureConnectionStart":137.70000000018626},{"duration":267.79999999981374,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":137.79999999981374,"connectEnd":137.79999999981374,"connectStart":137.79999999981374,"domainLookupEnd":137.79999999981374,"domainLookupStart":137.79999999981374,"fetchStart":137.79999999981374,"redirectEnd":0,"redirectStart":0,"requestStart":137.79999999981374,"responseEnd":405.59999999962747,"responseStart":405.59999999962747,"secureConnectionStart":137.79999999981374}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":57,"responseStart":129,"responseEnd":130,"domLoading":133,"domInteractive":893,"domContentLoadedEventStart":893,"domContentLoadedEventEnd":968,"domComplete":1320,"loadEventStart":1320,"loadEventEnd":1322,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"b8824b05041e0d","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":47,"dbReadsTimeInMs":4,"dbConnsTimeInMs":5,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Affected files:
1. trunk\WORKTERRAweb\Web\SharedFunctionWebTier\SharedFunctionWebTier\Modules\CustomModelBinder.cs
2. trunk\WORKTERRAweb\Web\Web Projects\Web.config
We have added new tag in config which will decide if we need to validate or condition or not. This tag is added to give flexibility of use of OR in input.
<add key="ValidateOROperatorForSQLInjection" value="true" />