Project SimpleProject Type: software

Project Simple

Uploaded image for project: 'Project Simple'
  1. Project Simple
  2. ST-256

SQL Injection : Block use of OR condition as input with quote

    Details

    • Type: Enhancement
    • Status: Closed
    • Priority: Critical
    • Resolution: Unresolved
    • Component/s: None
    • Labels:
      None
    • Module:
      BenAdmin - Security
    • Reported by:
      Harbinger
    • Item State:
      Development - Ready for Local Testing
    • Issue Importance:
      Must Have

      Description

      When we add input on notes category like asdf' or '1'='1 , category is getting added successfully.

      We should block use of OR with '. it should show sql injection character message.

        Attachments

          Activity

          Ascending order - Click to sort in descending order
          vijayendra Vijayendra Shinde (Inactive) created issue -
          vijayendra Vijayendra Shinde (Inactive) made changes -
          Field Original Value New Value
          Summary SQL Injection OR condition generic implementation SQL Injection : Block use of OR condition as input with quote
          vijayendra Vijayendra Shinde (Inactive) made changes -
          Module Parent values: BenAdmin(10100) Parent values: BenAdmin(10100)Level 1 values: Security(10112)
          Hide
          Permalink
          vijayendra Vijayendra Shinde (Inactive) added a comment -

          Affected files:
          1. trunk\WORKTERRAweb\Web\SharedFunctionWebTier\SharedFunctionWebTier\Modules\CustomModelBinder.cs

          2. trunk\WORKTERRAweb\Web\Web Projects\Web.config

          We have added new tag in config which will decide if we need to validate or condition or not. This tag is added to give flexibility of use of OR in input.

          <add key="ValidateOROperatorForSQLInjection" value="true" />

          Show
          vijayendra Vijayendra Shinde (Inactive) added a comment - Affected files: 1. trunk\WORKTERRAweb\Web\SharedFunctionWebTier\SharedFunctionWebTier\Modules\CustomModelBinder.cs 2. trunk\WORKTERRAweb\Web\Web Projects\Web.config We have added new tag in config which will decide if we need to validate or condition or not. This tag is added to give flexibility of use of OR in input. <add key="ValidateOROperatorForSQLInjection" value="true" />
          vijayendra Vijayendra Shinde (Inactive) made changes -
          Item State Parent values: Development(10200)Level 1 values: In Progress(10206) Parent values: Development(10200)Level 1 values: Ready for Local Testing(10209)
          vijayendra Vijayendra Shinde (Inactive) made changes -
          Status New Request [ 10029 ] Pending for Approval [ 10002 ]
          vijayendra Vijayendra Shinde (Inactive) made changes -
          Status Pending for Approval [ 10002 ] Rejected [ 10004 ]
          Hide
          Permalink
          vijayendra Vijayendra Shinde (Inactive) added a comment -

          Duplicate with : WT-3873: Verify OR logical condition with single quote for SQL Injection

          Show
          vijayendra Vijayendra Shinde (Inactive) added a comment - Duplicate with : WT-3873 : Verify OR logical condition with single quote for SQL Injection
          vijayendra Vijayendra Shinde (Inactive) made changes -
          Status Rejected [ 10004 ] Closed [ 6 ]
          Transition Time In Source Status Execution Times
          Vijayendra Shinde (Inactive) made transition -
          New Request Pending for Approval
          		20d 23h 53m 1
          Vijayendra Shinde (Inactive) made transition -
          Pending for Approval Rejected
          		11s 1
          Vijayendra Shinde (Inactive) made transition -
          Rejected Closed
          		33s 1

            People

            Assignee:
            Unassigned
            Reporter:
            vijayendra Vijayendra Shinde (Inactive)
            Developer:
            Vijayendra Shinde (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated: