up vote 13 down vote favorite
2
share [g+] share [fb]

I know that to prevent (prevent all or most?) SQL injection attacks that you should use parametrized queries. I've been using hibernate for a while instead of hand writing my sql statements. Are there any known attacks or research that is directed toward exploiting this layer?

link|improve this question
feedback

2 Answers

up vote 10 down vote accepted

No, you are not automatically safe.
SQL Injection can still exist.

From the OWASP page:

A note about SQL injection

Since it is the hot topic, I will address it now but discuss in detail later.

  • Hibernate does not grant immunity to SQL Injection, one can misuse the api as they please.
  • There is nothing special about HQL (Hibernates subset of SQL) that makes it any more or less susceptible.
  • Functions such as createQuery(String query) and createSQLQuery(String query) create a Query object that will be executed when the call to commit() is made. If the query string is tainted you have sql injection. The details of these functions are covered later.
link|improve this answer
I guess the key here is the misuse of the custom createQuery functions. If I am creating a query on the fly using HQL and I am concatenating strings together that would still cause the same issue. What about strictly using the criteria api though? – Casey Dec 9 '10 at 20:21
@casey no, you can still muck things up – Woot4Moo Dec 9 '10 at 21:50
I might pursue this further as a lot of people I have encountered recently seem to think that using hibernate or other ORM frameworks handles this. – Casey Dec 10 '10 at 0:45
@Woot4Moo Interesting to hear that. Can you give a couple of examples of where it's possible to go wrong with an ORM without using it to concatenate strings? – Rory McCune Dec 10 '10 at 16:51
1  
@Rory in the article that AviD supplied the author looks at the core api of hibernate to expose some of its weaknesses as well as common design flaws – Woot4Moo Dec 10 '10 at 17:36
feedback
up vote 3 down vote

In addition to the other answers, one area where ORMs may not help, is where there is an Issue with the ORM code itself. For example there were a couple of issues with ActiveRecord in Rails some versions ago where the SQL injection was in the framework itself rather in user created code.

That said correctly using an ORM does make it much easier to avoid SQL injection, so it'd be a good strategy to persue, as opposed to hand crafting queries.

link|improve this answer
That is true - even though it's not a silver bullet, and should not be treated as such, it definitely makes it much easier to avoid SQL Injection. – AviD♦ Dec 11 '10 at 20:22
Very true - use of an ORM such as Hibernate encourages you to use safe APIs and approaches. If you want to have a look at the logical endpoint, Microsoft's LINQ implementation is almost impossible to write SQL injectable code in by accident. – Justin Clarke Dec 22 '10 at 23:29
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.