Code for BAEL-1381 (#6214)

* BAEL-1381 * [BAEL-1381] * [BAEL-1381] New module name * [BAEL-1381] software-security module
2019-01-31 00:16:26 -02:00
parent f1ea814185
commit 4d1c8634fa
13 changed files with 390 additions and 1 deletions
@@ -0,0 +1,169 @@
+/**
+ * 
+ */
+package com.baeldung.examples.security.sql;
+
+import java.sql.Connection;
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import javax.sql.DataSource;
+
+import org.springframework.stereotype.Component;
+
+/**
+ * @author Philippe
+ *
+ */
+@Component
+public class AccountDAO {
+
+    private final DataSource dataSource;
+
+    public AccountDAO(DataSource dataSource) {
+        this.dataSource = dataSource;
+    }
+
+    /**
+     * Return all accounts owned by a given customer,given his/her external id
+     * 
+     * @param customerId
+     * @return
+     */
+    public List<AccountDTO> unsafeFindAccountsByCustomerId(String customerId) {
+
+        String sql = "select " + "customer_id,acc_number,branch_id,balance from Accounts where customer_id = '" + customerId + "'";
+
+        try (Connection c = dataSource.getConnection();
+            ResultSet rs = c.createStatement()
+                .executeQuery(sql)) {
+            List<AccountDTO> accounts = new ArrayList<>();
+            while (rs.next()) {
+                AccountDTO acc = AccountDTO.builder()
+                    .customerId(rs.getString("customer_id"))
+                    .branchId(rs.getString("branch_id"))
+                    .accNumber(rs.getString("acc_number"))
+                    .balance(rs.getBigDecimal("balance"))
+                    .build();
+
+                accounts.add(acc);
+            }
+
+            return accounts;
+        } catch (SQLException ex) {
+            throw new RuntimeException(ex);
+        }
+    }
+
+    /**
+     * Return all accounts owned by a given customer,given his/her external id
+     * 
+     * @param customerId
+     * @return
+     */
+    public List<AccountDTO> safeFindAccountsByCustomerId(String customerId) {
+
+        String sql = "select " + "customer_id,acc_number,branch_id,balance from Accounts where customer_id = ?";
+
+        try (Connection c = dataSource.getConnection(); PreparedStatement p = c.prepareStatement(sql)) {
+            p.setString(1, customerId);
+            ResultSet rs = p.executeQuery();
+            List<AccountDTO> accounts = new ArrayList<>();
+            while (rs.next()) {
+                AccountDTO acc = AccountDTO.builder()
+                    .customerId(rs.getString("customerId"))
+                    .branchId(rs.getString("branch_id"))
+                    .accNumber(rs.getString("acc_number"))
+                    .balance(rs.getBigDecimal("balance"))
+                    .build();
+
+                accounts.add(acc);
+            }
+            return accounts;
+        } catch (SQLException ex) {
+            throw new RuntimeException(ex);
+        }
+    }
+
+    private static final Set<String> VALID_COLUMNS_FOR_ORDER_BY = Stream.of("acc_number", "branch_id", "balance")
+        .collect(Collectors.toCollection(HashSet::new));
+
+    /**
+     * Return all accounts owned by a given customer,given his/her external id
+     * 
+     * @param customerId
+     * @return
+     */
+    public List<AccountDTO> safeFindAccountsByCustomerId(String customerId, String orderBy)  {
+
+        String sql = "select " + "customer_id,acc_number,branch_id,balance from Accounts where customer_id = ? ";
+
+        if (VALID_COLUMNS_FOR_ORDER_BY.contains(orderBy)) {
+            sql = sql + " order by " + orderBy;
+        }
+        else {
+            throw new IllegalArgumentException("Nice try!");
+        }
+
+        try (Connection c = dataSource.getConnection(); PreparedStatement p = c.prepareStatement(sql)) {
+
+            p.setString(1, customerId);
+            ResultSet rs = p.executeQuery();
+            List<AccountDTO> accounts = new ArrayList<>();
+            while (rs.next()) {
+                AccountDTO acc = AccountDTO.builder()
+                    .customerId(rs.getString("customerId"))
+                    .branchId(rs.getString("branch_id"))
+                    .accNumber(rs.getString("acc_number"))
+                    .balance(rs.getBigDecimal("balance"))
+                    .build();
+
+                accounts.add(acc);
+            }
+
+            return accounts;
+        } catch (SQLException ex) {
+            throw new RuntimeException(ex);
+        }
+    }
+
+    /**
+     * Invalid placeholder usage example 
+     * 
+     * @param tableName 
+     * @return
+     */
+    public List<AccountDTO> wrongCountRecordsByTableName(String tableName) {
+
+        try (Connection c = dataSource.getConnection(); 
+             PreparedStatement p = c.prepareStatement("select count(*) from ?")) {
+            
+            p.setString(1, tableName);
+            ResultSet rs = p.executeQuery();
+            List<AccountDTO> accounts = new ArrayList<>();
+            while (rs.next()) {
+                AccountDTO acc = AccountDTO.builder()
+                    .customerId(rs.getString("customerId"))
+                    .branchId(rs.getString("branch_id"))
+                    .accNumber(rs.getString("acc_number"))
+                    .balance(rs.getBigDecimal("balance"))
+                    .build();
+
+                accounts.add(acc);
+            }
+
+            return accounts;
+        } catch (SQLException ex) {
+            throw new RuntimeException(ex);
+        }
+    }
+
+}
@@ -0,0 +1,16 @@
+package com.baeldung.examples.security.sql;
+
+import java.math.BigDecimal;
+
+import lombok.Builder;
+import lombok.Data;
+
+@Data
+@Builder
+public class AccountDTO {
+    
+    private String customerId;
+    private String accNumber;
+    private String branchId;
+    private BigDecimal balance;
+}
@@ -0,0 +1,14 @@
+package com.baeldung.examples.security.sql;
+
+import org.springframework.boot.SpringApplication;
+import org.springframework.boot.autoconfigure.SpringBootApplication;
+
+@SpringBootApplication
+public class SqlInjectionSamplesApplication {
+
+	public static void main(String[] args) {
+		SpringApplication.run(SqlInjectionSamplesApplication.class, args);
+	}
+
+}
+
@@ -0,0 +1,19 @@
+<databaseChangeLog
+  xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+         http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+
+	<changeSet id="create-tables" author="baeldung">
+		<createTable tableName="Accounts" >
+			<column name="id" autoIncrement="true" type="BIGINT" remarks="Internal account PK" >
+				<constraints primaryKey="true"/>				
+			</column>
+			<column name="customer_id" type="java.sql.Types.VARCHAR(32)" remarks="External Customer Id"></column> 
+			<column name="acc_number" type="java.sql.Types.VARCHAR(128)" remarks="External Account Number"></column> 
+			<column name="branch_id" type="java.sql.Types.VARCHAR(32)"></column>	
+			<column name="balance" type="CURRENCY"></column>
+			
+		</createTable>
+	</changeSet>
+</databaseChangeLog>
@@ -0,0 +1,8 @@
+<databaseChangeLog
+  xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+         http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-3.1.xsd">
+
+  <include file="changelog/create-tables.xml" relativeToChangelogFile="true"/>
+</databaseChangeLog>