1

If I commit the name of SQLite database in the JDBC SQLite URI in the source code like below, is it possible for an attacker to exploit the URI?

Should I replace the name of the SQLite db with code to retrieve it from environmental variables?

// create a database connection
connection = DriverManager.getConnection("jdbc:sqlite:statistics.db");
1
  • 3
    Please do not add code as an image, add it in code blocks instead.
    – Wouter
    Commented Dec 2, 2023 at 11:24

2 Answers 2

1

There is no observable difference

Whether you get the name of the SQLite database from an environment variable, a configuration file or statically hardcoded in your executable does not matter.

The name of the database file isn't confidential, nor could it realistically be confidential, nor would moving the name to an environment variable make it confidential.

The only advantage putting the name into an environment variable or configuration file is that users can easily swap out the database file for another. But that's a usability concern, and not a security one.

2
  • Does it mean that having the JDBC URI for SQLite database hardcoded in source code does not lead to any security vulnerability? Commented Dec 3, 2023 at 20:54
  • @SetuKumarBasak Correct.
    – Sergej
    Commented Dec 4, 2023 at 7:48
0

It's always better to use .env file to store sensitive information. Yes, DB names are sensitive too. In my opinion - Any piece of information, that makes the attack easier, is sensitive and should not be disclosed or leaked.

Usually, This sort of information gets leaked due unhandled exceptions or errors. So, it's always better to avoid hardcoding it. You can read about it in invicti

2
  • The link you shared where it is written that "An attacker can perform brute-force or dictionary-based password guessing on the disclosed database name". However for SQLite, we do no have any password and databases are shipped with application packages. In such cases, will it be vulnerable? Commented Dec 3, 2023 at 5:32
  • Not a vulnerability. We can call it weakness. Hypothetically, if the sqlite3 directory is exposed in a servable directory, it makes the job easier to download it. Commented Dec 19, 2023 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .