Veracode reports SQL Injection | CWE 89
Nobody has claimed this yet.
- Dominant language
- C#
- Stars
- 18.4k
- Forks
- 3.7k
- Avg merge
- 5h 8m
- Merged PRs (30d)
- 1
Description
Veracode static scan reports SQL injection on following methods,
dapper.dll -> SqlMapper.cs -> ExecuteCommand
dapper.dll -> SqlMapper.cs -> ExecuteReaderWithFlagsFallback
Recommendations:
Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the
database from interpreting the contents of bind variables as part of the query. Always validate untrusted input to
ensure that it conforms to the expected format, using centralized data validation routines when possible.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in SqlMapper.cs at ExecuteCommand and ExecuteReaderWithFlagsFallback, then review the Veracode SQL injection report and how these methods construct and execute queries. Confirm whether untrusted input can alter SQL interpretation, and consider the issue done when the reported findings are addressed and the affected behavior remains correct.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, sql
- Domain
- databases, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100