-
Type:
Enhancement
-
Status:
Closed
-
Priority:
Critical
-
Resolution:
Unresolved
-
Component/s:
None
-
-
Module:
BenAdmin
- Security
-
-
Item State:
Development
- Ready for Local Testing
-
Issue Importance:
Must Have
When we add input on notes category like asdf' or '1'='1 , category is getting added successfully.
We should block use of OR with '. it should show sql injection character message.
{"report":{"apdex":1,"isInitial":true,"journeyId":"5b4ae143-fa17-4f0c-afed-0e8af9d3eb82","key":"jira.project.issue.view-issue","navigationType":0,"readyForUser":623.3000001907349,"redirectCount":0,"resourceLoadedEnd":804.2000002861023,"resourceLoadedStart":151.40000009536743,"resourceTiming":[{"duration":83.5,"initiatorType":"link","name":"https://jira.workterra.net/s/3003653444a1e1a85555cab7dcfb3a21-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/css/_super/batch.css","startTime":151.40000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":151.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":234.90000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":83.30000019073486,"initiatorType":"link","name":"https://jira.workterra.net/s/dd6a0911920485696ac20493290df627-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true","startTime":151.59999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":151.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":234.90000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":83.19999980926514,"initiatorType":"link","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.css","startTime":151.80000019073486,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":151.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":235,"responseStart":0,"secureConnectionStart":0},{"duration":83.19999980926514,"initiatorType":"link","name":"https://jira.workterra.net/s/bd548f27bbf8f278bd83b60dd3284ed8-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static-adgs/jira.webresources:global-static-adgs.css","startTime":151.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":151.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":235.09999990463257,"responseStart":0,"secureConnectionStart":0},{"duration":83.30000019073486,"initiatorType":"link","name":"https://jira.workterra.net/s/70725731a158a7140f19ddbd4201ba27-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:global-static/jira.webresources:global-static.css","startTime":151.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":151.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":235.2000002861023,"responseStart":0,"secureConnectionStart":0},{"duration":92.30000019073486,"initiatorType":"script","name":"https://jira.workterra.net/s/f2623af22c15df767ec6ff268ae0b8bd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/2e46d90b5cae895c9c38649c9d510130/_/download/contextbatch/js/_super/batch.js?locale=en-US","startTime":152.09999990463257,"connectEnd":152.09999990463257,"connectStart":152.09999990463257,"domainLookupEnd":152.09999990463257,"domainLookupStart":152.09999990463257,"fetchStart":152.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":152.09999990463257,"responseEnd":244.40000009536743,"responseStart":244.40000009536743,"secureConnectionStart":152.09999990463257},{"duration":123.2999997138977,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/4.1.5/_/download/resources/com.atlassian.plugins.atlassian-chaperone:hotspot-tour/hotspot-tour.js?batch=false&locale=en-US","startTime":152.2000002861023,"connectEnd":152.2000002861023,"connectStart":152.2000002861023,"domainLookupEnd":152.2000002861023,"domainLookupStart":152.2000002861023,"fetchStart":152.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":152.2000002861023,"responseEnd":275.5,"responseStart":275.5,"secureConnectionStart":152.2000002861023},{"duration":120.19999980926514,"initiatorType":"script","name":"https://jira.workterra.net/s/6ce676f2a5bcc9651cef6e7956f05def-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/3abe50d469404b639745df44b51476b6/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,jira.global,atl.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":152.2000002861023,"connectEnd":152.2000002861023,"connectStart":152.2000002861023,"domainLookupEnd":152.2000002861023,"domainLookupStart":152.2000002861023,"fetchStart":152.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":152.2000002861023,"responseEnd":272.40000009536743,"responseStart":272.40000009536743,"secureConnectionStart":152.2000002861023},{"duration":123.69999980926514,"initiatorType":"script","name":"https://jira.workterra.net/s/6aa3fcf1fac5fd551eee0b69077524e6-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/aae1242f5fc81cc6a5bb8bc963ccda29/_/download/contextbatch/js/atl.global,-_super/batch.js?locale=en-US","startTime":152.40000009536743,"connectEnd":152.40000009536743,"connectStart":152.40000009536743,"domainLookupEnd":152.40000009536743,"domainLookupStart":152.40000009536743,"fetchStart":152.40000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":152.40000009536743,"responseEnd":276.09999990463257,"responseStart":276.09999990463257,"secureConnectionStart":152.40000009536743},{"duration":126.10000038146973,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":152.59999990463257,"connectEnd":152.59999990463257,"connectStart":152.59999990463257,"domainLookupEnd":152.59999990463257,"domainLookupStart":152.59999990463257,"fetchStart":152.59999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":152.59999990463257,"responseEnd":278.7000002861023,"responseStart":278.7000002861023,"secureConnectionStart":152.59999990463257},{"duration":126.39999961853027,"initiatorType":"script","name":"https://jira.workterra.net/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":152.7000002861023,"connectEnd":152.7000002861023,"connectStart":152.7000002861023,"domainLookupEnd":152.7000002861023,"domainLookupStart":152.7000002861023,"fetchStart":152.7000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":152.7000002861023,"responseEnd":279.09999990463257,"responseStart":279.09999990463257,"secureConnectionStart":152.7000002861023},{"duration":126.7999997138977,"initiatorType":"script","name":"https://jira.workterra.net/s/ecf7ec549751ae117b778f0525d6d371-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/8.5.0/_/download/batch/com.atlassian.auiplugin:split_aui.pattern.label/com.atlassian.auiplugin:split_aui.pattern.label.js?locale=en-US","startTime":152.80000019073486,"connectEnd":152.80000019073486,"connectStart":152.80000019073486,"domainLookupEnd":152.80000019073486,"domainLookupStart":152.80000019073486,"fetchStart":152.80000019073486,"redirectEnd":0,"redirectStart":0,"requestStart":152.80000019073486,"responseEnd":279.59999990463257,"responseStart":279.59999990463257,"secureConnectionStart":152.80000019073486},{"duration":127.30000019073486,"initiatorType":"link","name":"https://jira.workterra.net/s/05c862146699bb029ceb0a489075e63b-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/bcd66e9a133a1b9f5fd14b56841e1c5b/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":152.90000009536743,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":152.90000009536743,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":280.2000002861023,"responseStart":0,"secureConnectionStart":0},{"duration":127,"initiatorType":"script","name":"https://jira.workterra.net/rest/api/1.0/shortcuts/805012/ea6f30d2bfdc99578bb23f4a5bac3ecd/shortcuts.js?context=issuenavigation&context=issueaction","startTime":153,"connectEnd":153,"connectStart":153,"domainLookupEnd":153,"domainLookupStart":153,"fetchStart":153,"redirectEnd":0,"redirectStart":0,"requestStart":153,"responseEnd":280,"responseStart":280,"secureConnectionStart":153},{"duration":127.30000019073486,"initiatorType":"link","name":"https://jira.workterra.net/s/9095228fa10daa2d3e3d7d5760c95e91-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":153.09999990463257,"connectEnd":0,"connectStart":0,"domainLookupEnd":0,"domainLookupStart":0,"fetchStart":153.09999990463257,"redirectEnd":0,"redirectStart":0,"requestStart":0,"responseEnd":280.40000009536743,"responseStart":0,"secureConnectionStart":0},{"duration":127.2999997138977,"initiatorType":"script","name":"https://jira.workterra.net/s/c19a1b46e985d7fb85efaf27c8febfdd-CDN/-w431t5/805012/9a9e1fae3639050b38ac467c3aa37e79/72477c22780abda5f51fe696920d843f/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-US&richediton=true","startTime":153.2000002861023,"connectEnd":153.2000002861023,"connectStart":153.2000002861023,"domainLookupEnd":153.2000002861023,"domainLookupStart":153.2000002861023,"fetchStart":153.2000002861023,"redirectEnd":0,"redirectStart":0,"requestStart":153.2000002861023,"responseEnd":280.5,"responseStart":280.5,"secureConnectionStart":153.2000002861023}],"threshold":1000,"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":0,"connectEnd":0,"requestStart":77,"responseStart":146,"responseEnd":147,"domLoading":150,"domInteractive":829,"domContentLoadedEventStart":829,"domContentLoadedEventEnd":868,"domComplete":1097,"loadEventStart":1097,"loadEventEnd":1099,"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","marks":[],"measures":[],"correlationId":"128f22159ee20c","effectiveType":"4g","downlink":10,"rtt":0,"serverDuration":47,"dbReadsTimeInMs":3,"dbConnsTimeInMs":4,"applicationHash":"156decd7d2b4272533aa6cefc8294af635e1da97","experiments":[]}}
Affected files:
1. trunk\WORKTERRAweb\Web\SharedFunctionWebTier\SharedFunctionWebTier\Modules\CustomModelBinder.cs
2. trunk\WORKTERRAweb\Web\Web Projects\Web.config
We have added new tag in config which will decide if we need to validate or condition or not. This tag is added to give flexibility of use of OR in input.
<add key="ValidateOROperatorForSQLInjection" value="true" />