/security-review

Injection Prevention Reference

Overview

Injection flaws occur when untrusted data is sent to an interpreter as part of a command or query. The attacker's hostile data tricks the interpreter into executing unintended commands or accessing data without proper authorization.

SQL Injection

Primary Defenses

1. Prepared Statements (Parameterized Queries) - REQUIRED

The database distinguishes between code and data regardless of user input.

// SAFE: Parameterized query
String query = "SELECT * FROM users WHERE username = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, userInput);

# SAFE: Parameterized query
cursor.execute("SELECT * FROM users WHERE username = %s", (user_input,))

// SAFE: Parameterized query (node-postgres)
const result = await client.query('SELECT * FROM users WHERE id = $1', [userId]);

2. Stored Procedures

Safe when implemented without dynamic SQL construction.

// SAFE: Stored procedure
CallableStatement cs = connection.prepareCall("{call sp_getUser(?)}");
cs.setString(1, username);

3. Allow-list Input Validation

For elements that cannot be parameterized (table names, column names, sort order).

// SAFE: Allowlist for table names
switch(tableName) {
    case "users": return "users";
    case "orders": return "orders";
    default: throw new InputValidationException("Invalid table");
}

Vulnerable Patterns to Find

# VULNERABLE: String concatenation
query = "SELECT * FROM users WHERE name = '" + user_input + "'"

# VULNERABLE: f-string interpolation
query = f"SELECT * FROM users WHERE id = {user_id}"

# VULNERABLE: format() method
query = "SELECT * FROM users WHERE name = '{}'".format(user_input)

// VULNERABLE: Template literal
const query = `SELECT * FROM users WHERE id = ${userId}`;

// VULNERABLE: String concatenation
const query = "SELECT * FROM users WHERE name = '" + userName + "'";

ORM Safety Considerations

Django ORM

# SAFE: ORM methods
User.objects.filter(username=user_input)

# VULNERABLE: raw() with interpolation
User.objects.raw(f"SELECT * FROM users WHERE name = '{user_input}'")

# VULNERABLE: extra() with unvalidated input
User.objects.extra(where=[f"name = '{user_input}'"])

SQLAlchemy

# SAFE: ORM methods
session.query(User).filter(User.name == user_input)

# VULNERABLE: text() with interpolation
session.execute(text(f"SELECT * FROM users WHERE name = '{user_input}'"))

NoSQL Injection

MongoDB Injection Patterns

// VULNERABLE: User-controlled query operators
db.users.find({ username: req.body.username, password: req.body.password });
// Attack: { "username": "admin", "password": { "$gt": "" } }

// SAFE: Explicit type checking
const username = String(req.body.username);
const password = String(req.body.password);
db.users.find({ username: username, password: password });

Dangerous Operators

• $where - Allows JavaScript execution
• $regex - Can be used for ReDoS
• $gt, $ne, $in - Query manipulation when user-controlled

OS Command Injection

Primary Defenses

1. Avoid Shell Commands - PREFERRED

Use language built-in functions instead of shell commands.

# VULNERABLE: Shell command
os.system(f"mkdir {directory_name}")

# SAFE: Built-in function
os.makedirs(directory_name, exist_ok=True)

2. Parameterization

# VULNERABLE: Shell=True with user input
subprocess.run(f"convert {input_file} {output_file}", shell=True)

# SAFE: List of arguments, shell=False
subprocess.run(["convert", input_file, output_file], shell=False)

3. Input Validation

# Allowlist for permitted commands
ALLOWED_COMMANDS = {"convert", "resize", "rotate"}
if command not in ALLOWED_COMMANDS:
    raise ValueError("Invalid command")

# Validate arguments against safe patterns
if not re.match(r'^[a-zA-Z0-9_\-\.]+$', filename):
    raise ValueError("Invalid filename")

Dangerous Characters

Block or escape: & | ; $ > < \ ! ' " ( ) { } [ ] \n \r

Language-Specific Dangerous Functions

LDAP Injection

Prevention

// SAFE: Escape special characters
String safeName = LdapEncoder.filterEncode(userName);
String filter = "(&(uid=" + safeName + ")(userPassword=" + safePassword + "))";

Characters to Escape in LDAP

• Filter context: * ( ) \ NUL
• DN context: \ # + < > ; " = /

Template Injection

Server-Side Template Injection (SSTI)

# VULNERABLE: User input in template
template = Template(f"Hello {user_input}")

# SAFE: Pass user input as variable
template = Template("Hello {{ name }}")
template.render(name=user_input)

Detection Payloads

• Jinja2: {{7*7}} → 49
• FreeMarker: ${7*7} → 49
• Thymeleaf: [[${7*7}]] → 49

XPath Injection

Prevention

// VULNERABLE: String concatenation
String query = "//users/user[name='" + userName + "']";

// SAFE: Use parameterized XPath
XPathExpression expr = xpath.compile("//users/user[name=$name]");
expr.setVariable("name", userName);

Key Grep Patterns for Detection

# SQL Injection
grep -rn "execute.*+" --include="*.py"
grep -rn "raw_sql\|rawQuery\|raw(" --include="*.py" --include="*.js"
grep -rn "\\.query\\(.*\\+" --include="*.js"
grep -rn "\\$.*\\+" --include="*.php"

# Command Injection
grep -rn "os\\.system\\|subprocess\\.run.*shell=True\\|os\\.popen" --include="*.py"
grep -rn "child_process\\.exec" --include="*.js"
grep -rn "system(\\|exec(\\|shell_exec(" --include="*.php"

# Template Injection
grep -rn "Template(.*\\+" --include="*.py"
grep -rn "render_template_string" --include="*.py"

# LDAP Injection
grep -rn "ldap_search\\|ldap_bind" --include="*.py" --include="*.php"

References

• OWASP SQL Injection Prevention
• OWASP OS Command Injection Defense
• OWASP LDAP Injection Prevention
• CWE-89: SQL Injection
• CWE-78: OS Command Injection