Improper neutralization of special elements used in an SQLCOMMAND('sql injection')

Question

Hello everyone,
Please help with this SQL Injection flaw of veracode and refer to below code.

Recommendations:
Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query. Always validate user-supplied input to ensure that it conforms to the expected format, using centralized data validation routines when possible.

Source code:

Public Sub AddParameter(ByVal parmName As String, ByVal parmValue As String, _
ByVal parmType As SqlDbType, ByVal parmDirection As Direction, _
Optional ByVal parmSize As Integer = 0)

Dim Parameter As SqlParameter
DIM parms As ArrayList
parmDirection = Direction.input Then
Parameter = New SqlParameter(parmName, parmValue)
Parameter.Direction = ParameterDirection.Input
Parameter.SqlDbType = parmType
parms.Add(Parameter)
End Sub

'calling function to DB call and addparameter functions
Public Function Employeenumber(ByVal ENumber As String) As Boolean
Try
DBAccessor = New DBAccessor.DBAccessor
DBAccessor.LookupConnectionString("Sample")
DBAccessor.setCmdText("StoredProcedurename")
DBAccessor.AddParameter("@parametername", Nothing, SqlDbType.VarChar, DBAccessor.DBAccessor.Direction.input)
objDataset = DBAccessor.MakeDBCall
Return True
Catch ex As Exception
Return False
Finally
DBAccessor.CloseConnection()
DBAccessor = Nothing
End Try
End Function

Public Function MakeDBCall() As DataSet

Try

Dim DataSet As DataSet = New DataSet
Dim Command As New SqlCommand

Dim i As Integer
Con = New SqlConnection(connectionString)
'Open connection and set the adapater for a stored procedure.
Con.Open()
Adapter.SelectCommand = Command
Adapter.SelectCommand.Connection = Con
Adapter.SelectCommand.CommandType = CommandType.StoredProcedure'type stored procedure
Adapter.SelectCommand.CommandText = cmdText'StoredProcedure name

'Add parameters
For i = 0 To (parms.Count - 1)
Adapter.SelectCommand.Parameters.Add(parms(i))
Next

Adapter.Fill(DataSet)
Return DataSet

Catch ex As Exception

Return Nothing
End Try

End Function

Answer 1

I don't see any vulnerability. Can you please clarify exactly where this is being reported at or is this coming from some security scanner that you ran that can possibly report false positives.

To prevent SQL injection all you really need do is ensure that you never set CommandText of a command to input provided by an end user or containing string concatenation of user input. That is what parameters are for. It looks like you're doing that here so SQL injection shouldn't be a problem.

Answer 2

I agree with @Michael Taylor in regards to not seeing vulnerabilities.

• One should always consider All Input as Evil from users.
• Execute statements with Least Privilege permissions so if a hacker does figure out getting into your backend they are constrained e.g. can't drop a table.
• Although not part of what's shown, always encrypt connection strings, most coders never consider this.
• Failing Gracefully, no exception handling can possible lead a hacker down a path to a better understanding of your data
• Consider sanitizing methods, Avoiding Security and Usability Disasters
• Don't see using stored procedures as protection against attacks.
• Check out the following cheat sheet for common attacks

Answer 3

Is there any way I can bypass this flaw in a vercode static scan?