[JBSEAM-2084] (security) EJB-QL injection in org.jboss.seam.framework.Query - Red Hat Issue Tracker

Workaround:

Workaround Exists
Workaround Description:

Hide

Quick fix in derived class:

@Name("blaList")
public class BlaList extends EntityQuery {
[...]
private static final String[] ORDERS =
{"name asc","name desc","id asc","id desc"}
;

@Override
public void setOrder(String order) {
if (Arrays.asList(ORDERS).contains(order))
{ super.setOrder(order); }
}

Show
Quick fix in derived class: @Name("blaList") public class BlaList extends EntityQuery { [...] private static final String[] ORDERS = {"name asc","name desc","id asc","id desc"} ; @Override public void setOrder(String order) { if (Arrays.asList(ORDERS).contains(order)) { super.setOrder(order); } }

There is a security hole in class: org.jboss.seam.framework.Query in method: getRenderedEjbql(). This method generate EJB-QL query in this way:

if ( getOrder()!=null ) builder.append(" order by ").append( getOrder() );
return builder.toString();

"Order" variable comes from request.

duplicates

JBSEAM-2099 Support protection against SQL injection in Query order parameter