0
\$\begingroup\$

im using spring boot and CrudRepository for my queries, the project is about posting content on a blog, so I have a post record with id, creator name, post name, the content itself likes and dislikes:

import org.springframework.data.annotation.Id;

public record Post(

    @Id
    Integer id,
    String creatorName,
    String postName,
    String content,
    int likes,
    int dislikes
) {
    
}

this is my PostController to set GET, SET, PUT etc... requests

@RestController
@RequestMapping("/api/posts")
public class PostController {
    //private final PostRepository repository;
    private final AccessingPostDataMySql repository;

    @Autowired
    public PostController(AccessingPostDataMySql repository) {
        this.repository = repository;
    }

    @GetMapping
    public List<Post> findAll() {
        System.out.println(repository);
        return (List<Post>) repository.findAll();
    }

    @GetMapping("/{id}")
    public Iterable<Post> findById(@PathVariable Iterable<Integer> id) {
        return repository.findAllById(id);
    }

    @PostMapping
    public void insertPost(@RequestBody Post post) {
        System.out.println(post.postName());
        repository.save(post);

    }

    @PutMapping("/likes/{id}")
    public int addLike(@PathVariable Integer id) throws Exception {
        repository.addLike();
        return 1;
    }

    @PutMapping("/dislikes/{id}")
    public int addDislike(@PathVariable Integer id) throws Exception {
        repository.addDislike();
        return 1;
    }
}

and for the repository I have the PostRepository interface extending CrudRepository to query my data base (which is MySql)

public interface AccessingPostDataMySql extends CrudRepository<Post, Integer> {

    @Modifying
    @Query("UPDATE post SET likes = likes + 1")
    void addLike();

    @Modifying
    @Query("UPDATE post SET dislikes = dislikes + 1")
    void addDislike();
    
}

now my question is does CrudRepository work well against SQL injections?, I also had to set up like and dislike queries myself as you can see, are those queries vulnerable to SQL injections? if so how can I protect my project against it?

\$\endgroup\$
1
  • \$\begingroup\$ The current question title, which states your concerns about the code, is too general to be useful here. Please edit to the site standard, which is for the title to simply state the task accomplished by the code. Please see How to get the best value out of Code Review: Asking Questions for guidance on writing good question titles. \$\endgroup\$ Commented Aug 25, 2023 at 15:10

1 Answer 1

-1
\$\begingroup\$

Spring Data JPA provides protection against SQL injection by using parameterized queries, when you create a method in @Repository that translated to SQL query by JPA back-end, it translated into parametrized query, which prevent SQL injection.

So in your classes, findAll, findId is protected against SQL injection.

Some examples of how parametrized to prevent SQL Injection

some definiton:

Parameterized queries help prevent SQL injection by ensuring that input data is treated as data and not executable SQL code. When you use parameterized queries, the values you provide are treated as values, not as part of the SQL query itself. This means that even if an attacker tries to insert malicious input, the database system interprets it as data, not as SQL code to execute.

example:

SELECT * FROM users WHERE username = ? AND password = ?

this query is vulnerable to SQL injection.

why ?

If now I set username to be '' OR 1=1. then the query always is vulnerable to hackers attacks.

\$\endgroup\$
1
  • 5
    \$\begingroup\$ Your example of a vulnerable query is incorrect, it is not vulnerable. As it is a parameterized query, the JDBC client will not parse the ['' OR 1=1]. Instead it will use the whole string as parameter when comparing it against username. A vulnerable example would be where the query was constructed by concatenating SQL snippets into input strings and then passing the constructed query to the JDBC client for parsing. \$\endgroup\$ Commented Sep 7, 2023 at 10:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.