GAE 数据存储和 JDOQL 的安全风险

发布于 2024-08-03 02:55:00 字数 406 浏览 3 评论 0原文

我刚刚开始开发一个将在谷歌应用程序引擎（GAE）上运行的项目。我正在使用java（wicket）和一些ajax。

我对关系数据库有丰富的经验，通常使用 iBatis 之类的数据库。当使用 JDO 查看 GAE 数据存储的文档和示例时，我发现他们正在执行以下内容：

String query = "select from " + Employee.class.getName() + " where lastName == 'Smith'";
List<Employee> employees = (List<Employee>) pm.newQuery(query).execute();

有谁知道这个 JDOQL 查询是否会遇到 SQL 注入等安全问题？如果是这样，有什么办法可以补救吗？

原文

I just started working on a project that will run on google app engine (GAE). I'm using java (wicket) with some ajax.

I'm experienced with relational databases and typically use something like iBatis. When going through the docs and examples for the GAE datastore using JDO I see that they're executing stuff like:

String query = "select from " + Employee.class.getName() + " where lastName == 'Smith'";
List<Employee> employees = (List<Employee>) pm.newQuery(query).execute();

Does anyone know if this JDOQL query is subject to security problems like SQL injection? If so, is there any way to remedy this?

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

风尘浪孓 2024-08-10 02:55:00

是的，这会受到 sql 注入的影响（在本例中是 JDOQL 注入）。您应该改用参数，如 GAE/J 文档中的示例所示。

Query query = pm.newQuery(Employee.class);
query.setFilter("lastName == lastNameParam");
query.setOrdering("hireDate desc");
query.declareParameters("String lastNameParam");

try {
    List<Employee> results = (List<Employee>) query.execute("Smith");
    if (results.iterator().hasNext()) {
        for (Employee e : results) {
            // ...
        }
    } else {
        // ... no results ...
    }
} finally {
    query.closeAll();
}

Yes, that is subject to sql injection (well, JDOQL injection in this case). You should use parameters instead, as in the examples in the GAE/J documentation.

Query query = pm.newQuery(Employee.class);
query.setFilter("lastName == lastNameParam");
query.setOrdering("hireDate desc");
query.declareParameters("String lastNameParam");

try {
    List<Employee> results = (List<Employee>) query.execute("Smith");
    if (results.iterator().hasNext()) {
        for (Employee e : results) {
            // ...
        }
    } else {
        // ... no results ...
    }
} finally {
    query.closeAll();
}

回复收藏 0 原文