hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-20 18:56:32 +01:00
Code Issues Packages Projects Releases Wiki Activity

Java: SQLInjection example for addJavaScriptInterface query

Browse Source
This commit is contained in:
Ed Minnix
2022-11-30 13:32:28 -05:00
parent d35321f40e
commit 04829fc38e
1 changed files with 16 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
java/ql/src/Security/CWE/CWE-079/AndroidWebViewAddJavascriptInterfaceExample.java
View File

@@ -1,11 +1,23 @@
class ExposedObject { import android.webkit.JavascriptInterface;
import android.database.sqlite.SQLiteOpenHelper;
class ExposedObject extends SQLiteOpenHelper {
@JavascriptInterface @JavascriptInterface
public String example() { public String studentEmail(String studentName) {
return "String from Java"; // SQL injection
String query = "SELECT email FROM students WHERE studentname = '" + studentName + "'";
Cursor cursor = db.rawQuery(query, null);
cursor.moveToFirst();
String email = cursor.getString(0);
return email;
} }
} }
webview.getSettings().setJavaScriptEnabled(true); webview.getSettings().setJavaScriptEnabled(true);
webview.addJavaScriptInterface(new ExposedObject(), "exposedObject"); webview.addJavaScriptInterface(new ExposedObject(), "exposedObject");
webview.loadData("", "text/html", null); webview.loadData("", "text/html", null);
webview.loadUrl("javascript:alert(exposedObject.example())");
String name = "Robert'; DROP TABLE students; --";
webview.loadUrl("javascript:alert(exposedObject.studentEmail(\""+ name +"\"))");