1

Background:

I have a workorder management system (WMS).

  • The WMS has functionality that allows users to save queries.
  • The queries are saved in a database table called QUERY (in a CLAUSE column).

An example of a value in the CLAUSE column would be:

((woclass = 'WORKORDER' or woclass = 'ACTIVITY') and contains(description,'$paint') > 0 and historyflag = 0 and istask = 0 and siteid = 'SERVICES')


Scenario:

I'm trying to learn how to properly integrate the WMS system with a separate GIS system (both systems are broswer-based/Oracle/internal systems).

I would like to utilize the saved WMS queries by integrating them into the GIS system's web map. I'll write a GIS web map widget (JavaScript) that would allow users to choose and execute queries from the QUERY table.

  • From a drop-down menu, choose a WHERE clause name from the QUERY table, extract the value from the CLAUSE column, and use it in a customized filtering tool (to query a GIS table).

Question:

Would the above-mentioned GIS widget be vulnerable to injection? If so, what can I do to make it safe?


I'm new to the IT industry and am trying to learn how to safely integrate/share queries between systems. Layman's terms would be appreciated.

1

No, your system doesn't need to have an injection vulnerability.

While you could implement these clauses easily (and insecurely) by doing an "eval", or tossing the result in a WHERE with no validation, it is possible to do that properly. You would parse the to verify it conforms to the proper format, and then build back a now-trusted query.

  • Thanks. Are there standard methods for parsing, verifying, and re-assembling complex WHERE clauses that I could use? Or do I need to write this from scratch? – User1973 Oct 9 at 13:05
  • It will depend on how complex you want to go. For a simple one a regex would be enough, such as ^wo(class|order) ([!<>]?=|NOT )?LIKE) '([^']|\\')+' ((and|or) wo(class|order) ([!<>]?=|NOT )?LIKE) '([^']|\\')+')*$ Complex queries will probably need an actual parser (such as one build with lex/yacc or the result or an ABNF grammer). Basically, you will want to forbid anything that would be allowed by the underlying SQL parser in the resulting, but that should not be allowed by the user, so you do that by making a parser that can validate that the input conforms to what *is allowed. – Ángel Oct 9 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.