mirror of
https://github.com/elicpeter/nyx.git
synced 2026-06-15 20:05:13 +02:00
20 lines
796 B
Java
20 lines
796 B
Java
// Phase 15 — Java JDBC raw-string concat SQLi positive.
|
|
// `Statement.executeQuery` is a flat SQL_QUERY sink in
|
|
// `labels/java.rs`; concatenated `request.getParameter` value flows
|
|
// directly into the SQL string with no parameterisation.
|
|
package com.example;
|
|
|
|
import java.sql.Connection;
|
|
import java.sql.DriverManager;
|
|
import java.sql.ResultSet;
|
|
import java.sql.Statement;
|
|
import javax.servlet.http.HttpServletRequest;
|
|
|
|
public class SqliJavaConcat {
|
|
public ResultSet lookup(HttpServletRequest request) throws Exception {
|
|
String name = request.getParameter("name");
|
|
Connection conn = DriverManager.getConnection("jdbc:h2:mem:db");
|
|
Statement stmt = conn.createStatement();
|
|
return stmt.executeQuery("SELECT * FROM users WHERE name = '" + name + "'");
|
|
}
|
|
}
|