Anti-SQL Injection

1) SQL injection generally means to trigger background execution of SQL query through malicious parameter input, to obtain data or damage the database.

2) Anti-SQL Injection is aimed to prevent SQL injection by following methods:

• Disable special keywords.

• Escape some characters.

Note: this feature only works for the FineReport templates.

1. User Interface

Click Manage -> Security -> Anti-SQL Injection and enter this page, as shown below:

2. Special Keywords

1) Enable special keywords

Forbid Keywords option is enabled by default:

Note: an error message will be thrown into the log when a disabled character is present in SQL parameters.

2) Add special keywords

• Click on Edit below Forbid Keywords switch to add new keywords or delete custom ones. Click on selected keywords to change it as unselected keywords, and vice versa.

• Click Add Special Keywords to add custom keywords.

  Note: custom keywords can be removed.

• Global search action can be conducted via the search box on the right, to display all the selected as well as unselected special keywords:

3) Preview the effect of disabling special keywords

Open the following template in FineReport designer: %FR_HOME%\webroot\WEB-INF\reportlets\GettingStartedEN.cpt, and preview it by Pagination Preview option.  In the browser, type "select" (which has been disabled in SQL parameters) into the textbox on the right of "Region", then click on Query and an error will be thrown into the log: "Due to the use of disabled special keywords, SQL injection attacks are suspected. Please contact the administrator for any needs.", as shown below:

3. Chars

1) Turn on escape char

Login the Decision-making System as an administrator, go to Manage -> Security -> Anti-SQL Injection and turn on Escape Char, then all the chars in SQL parameters that can be escaped will be converted to null:

2) Add characters

The steps to add characters are the same as adding special keywords. Please refer to section II.2. Add special keywords for more information.

4. Important Note

1) Problem description:

the system login page might go blank after adding escaped (), and login actions can't be performed.

2) Solution

() has special meaning in regular expressions and using () as an escape character will match all the related items, so the action of using comma (, ), period (. ) and parenthesis (()) as escape characters are prohibited by the system. If it must be used, please use \(\) as shown below: