Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString
as an Information Leakage. The ResultSet
is properly closed after its usage.
LAPSE+ does this only for ResultSet.getString()
and ResultSet.getObject()
. For example, ResultSet.getDate()
is not taken as a vulnerability. This behavior confirms to this OWASP page, which indicates only those two getters in ResultSet
as vulnerable.
I'm trying to figure out the reason behind this. Does it have something to do with Strings being immutable?
Though not the exact thing (due to confidentiality reasons), following is a sample code block that I'm concerned about:
ResultSet rs = null;
try {
dbConnection = dataSource.getConnection();
prepStmt = dbConnection.prepareStatement("SELECT NAME, DOB FROM CUSTOMERS WHERE ID=?");
prepStmt.setInt(1, customerId);
rs = prepStmt.executeQuery();
//do something
while (rs.next()) {
String name = rs.getString(1);
Date dob = rs.getDate(2);
//do something
}
} catch (SQLException e) {
//do something
} finally {
if (rs != null) {
try {
rs.close();
} catch (SQLException e) {
log.error("Database error. Could not close result set - " + e.getMessage(), e);
}
}
}