My team currently uses ASP.NET with MS SQL Server for our software. Security has only become important since I started, in which there is injection vulnerabilities everywhere.
Due to current integration with Oracle and MS SQL the business decision was never to use parameterized queries. This of course has been an issue.
Implementing Find and replace along with whitelisting of parameters has reduced this issue strongly.
My only issue is, I have read a lot about unicode and other encodings being the cause of sql injection. I dont quite understand this. Currently we sanitise everything like this:
Const pattern As String = "^[a-zA-Z0-9.=,:\s\\\/\']*$" term = term.Replace("'", "''") If Not Tools.ValidString(term, pattern) Then term = String.Empty End If Public Shared Function ValidString(ByVal source As String, ByVal pattern As String) As Boolean If source = String.Empty Then Return True Dim params As Text.RegularExpressions.RegexOptions = Text.RegularExpressions.RegexOptions.None Dim regex As New Text.RegularExpressions.Regex(pattern, params) Dim match As Text.RegularExpressions.Match = regex.Match(source, pattern, params) Return match.Success End Function
Does anyone have an example where unicode/encoded injection could be used, or just a plain example where this regular expression would fail to prevent sql injection.
Can I please not have answers related to standard SQL Injection. I am strongly familiar with this already. ALSO please stop posting saying don't use string sanitisation. There is zero resources in the company to shift all queries to parameterised queries with ADO.NET while also building in logic for it to use ODP.NET if the client uses oracle. OWASP mention the use of whitelisting of characters if parameterising is out of question, so like in the regex, only few characters are allowed. I am not blacklisting characters, as this is stupid.
There is no compliance required for the data we hold. The security is for database integrity, as it would be a nightmare if content was changed.
Our software is a very large cloud application CMS and DMS in one, where 99% of the software is used internal, and only a minority is external and is only used for public review and commenting on the documents.
From my new understanding of Unicode injection. It can only occur if the data is being encoded before being placed into the query, and therefore unicode injection only really occurs in applications with globalisation of data. I am passing raw string fields straight into the string query after the sanitisation above.
Can I please only have an answer from an expert in injection, who can back up my claim that Unicode will not apply in my circumstance?