|
Charles,assessment.
With respect, I do understand the issue. I simply disagree with your
important issue. I'd be happy to clarify the problem, but I don't know
Gary
-----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx
[mailto:rpg400-l-bounces@xxxxxxxxxxxx] On Behalf Of Charles Wilt
Sent: Monday, August 01, 2011 11:48 AM
To: RPG programming on the IBM i / System i
Subject: Re: Reduce large amount of logicals in SUBFL pgm,take in
another direction
Gary,
I wouldn't call this a matter of disagreement ...
With respect, you obviously don't understand the issue....but it's an
in a module...
Or perhaps you can explain why you think your code is safe because it's
it could be misued.
You might start by posting the actual code, along with sample usage...
Perhaps then somebody will be able to give you a concrete example of how
wrote:
Sincerely,
Charles
On Mon, Aug 1, 2011 at 2:25 PM, Monnier, Gary <Gary.Monnier@xxxxxxxxx>
building a statement dynamically with concatenation of user suppliedCharles,
So we choose to disagree.
Gary
-----Original Message-----
From: rpg400-l-bounces+gary.monnier=terex.com@xxxxxxxxxxxx
[mailto:rpg400-l-bounces+gary.monnier=terex.com@xxxxxxxxxxxx] On
Behalf Of Charles Wilt
Sent: Monday, August 01, 2011 11:19 AM
To: RPG programming on the IBM i / System i
Subject: Re: Reduce large amount of logicals in SUBFL pgm,take in
another direction
Gary,
You seem to be hung up on *MODULE...
I repeat, it doesn't matter where the statement is built. If you're
wrote:
Charles
On Mon, Aug 1, 2011 at 1:54 PM, Monnier, Gary <Gary.Monnier@xxxxxxxxx>
recommended *MODULE. If you feel someone can get to a *PGM build fromCharles,
With respect you seem to be hung up on my example being a *PGM. I
you are sadly mistaken...
Respectfully,
Gary Monnier
-----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx
[mailto:rpg400-l-bounces@xxxxxxxxxxxx] On Behalf Of Charles Wilt
Sent: Monday, August 01, 2011 6:06 AM
To: RPG programming on the IBM i / System i
Subject: Re: Reduce large amount of logicals in SUBFL pgm,take in
another direction
Gary,
If you think that your program doesn't open you up to SQL injection,
copy as opposed to a dynamic called *PGM has no bearing.
The fact that the procedure is bound statically by reference or by
statement and concatenate user string input into the statement. It
SQL injection attacks can occur anytime you dynamically build a
building a statement like so:
Again, all that matters is that in some way shape or form, you are
build a statement like so:wSqlStmt = 'SELECT * FROM MYTABLE WHERE MYFLD = ' +
userEnteredValue;
Theoretically, you could parse and sanitize the user input, making
sure it's safe before using it. However, unlike some languages RPG
doesn't have that functionality built in. Also, IMHO you're
dependent on the guy who wrote the sanitizer being smarter than the
hackers :)
The safe way to do dynamic statements is via parameter markers. You
parameter markers.wSqlStmt = 'SELECT * FROM MYTABLE WHERE MYFLD = ?';
then when you open/execute it, you pass in the variables to use at the
custom application code to identify coding vulnerabilities. Followopen C1 using :userEnteredValue;
With respect to PCI requirements...
6.5 Develop applications based on secure coding guidelines and review
top security risk for 2010...injection (SQL queries, LDAP queries, XPath
OWASP is one of the standards usually used for secure coding...their
review and you'd likely fail a PCI audit.https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
Thus, dynamic SQL as used by your programs would fail an secure code
<Gary.Monnier@xxxxxxxxx> wrote:
HTH,
Charles
On Fri, Jul 29, 2011 at 2:26 PM, Monnier, Gary
http://archive.midrange.com/rpg400-l.Your opinion Charles and what seems a very strong opinion. J
Yes, I've heard of SQL Injection attacks and no my suggestion does
not leave you open to this sort of attack. I've also heard of LDAP
injection attacks.
What I suggested does not impact PCI compliance or any other
security parameters. Nor does it impact FDA compliance. All the
MODULE does is build an SQL string. When bound with other modules
to make an executable object there are no compliance issues.
If you create ILE programs that allow updating modules or service
programs then you have a behavior that needs changing. My opinion
is, and it is only my opinion, you should NEVER create a program
with Allow update. You are just asking for trouble in the ILE world.
If you have ulcer causing issues with pgmToBuildSQL make it a copy
module rather than a bound module.
Regards,
Gary
-----Original Message-----
From: rpg400-l-bounces@xxxxxxxxxxxx
[mailto:rpg400-l-bounces@xxxxxxxxxxxx] On Behalf Of Charles Wilt
Sent: Friday, July 29, 2011 10:35 AM
To: RPG programming on the IBM i / System i
Subject: Re: Reduce large amount of logicals in SUBFL pgm,take in
another direction
Very, very BAD IDEA!
Horrible in fact.
I hope you're not subject to PCI compliance rules, as the code you
posted pretty much guarantees an automatic failure.
Try googleing for "SQL injection"...
Charles
On Fri, Jul 29, 2011 at 1:16 PM, Monnier, Gary
<Gary.Monnier@xxxxxxxxx <mailto:Gary.Monnier@xxxxxxxxx> > wrote:
Sharon,
The process that builds your SQL statement can have parameters
passed
to it. One of these parameters can be a list of selections.
Something like this.
pgmToBuildSQL PR
nbrFieldsForWhereClause
arrayOfFieldsForWhereClause
arrayOfValuesForWhereClause
SQLStringBegin = 'Select * From yourfile ';
X = 1;
startPos = 1;
doW (X < = nbrFieldsForWhereClause);
whereValue = arrayOfFieldsForWhereClause(X) +
arrayOfValuesForWhereClause(X); //ValueFor can be = value, like
value, etc
valueLen = %len(%trimr(whereValue));
%subst(whereClause:startPos:valueLen) = whereValue;
startpos = startPos + valueLen + 1;
X = X + 1;
enddo;
Return;
--
This is the RPG programming on the IBM i / System i (RPG400-L)
mailing list To post a message email: RPG400-L@xxxxxxxxxxxx
<mailto:RPG400-L@xxxxxxxxxxxx> To subscribe, unsubscribe, or
change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
<http://lists.midrange.com/mailman/listinfo/rpg400-l>
or email: RPG400-L-request@xxxxxxxxxxxx
<mailto:RPG400-L-request@xxxxxxxxxxxx>
Before posting, please take a moment to review the archives at
http://archive.midrange.com/rpg400-l
<http://archive.midrange.com/rpg400-l> .
--
This is the RPG programming on the IBM i / System i (RPG400-L)
mailing list To post a message email: RPG400-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/rpg400-l.--
This is the RPG programming on the IBM i / System i (RPG400-L)
mailing list To post a message email: RPG400-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/rpg400-l.
--
This is the RPG programming on the IBM i / System i (RPG400-L)
mailing list To post a message email: RPG400-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
------
This is the RPG programming on the IBM i / System i (RPG400-L)
mailing list To post a message email: RPG400-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/rpg400-l.
--
This is the RPG programming on the IBM i / System i (RPG400-L)
mailing list To post a message email: RPG400-L@xxxxxxxxxxxx To
subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/rpg400-l.
This is the RPG programming on the IBM i / System i (RPG400-L) mailing
list To post a message email: RPG400-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/rpg400-l.
--
This is the RPG programming on the IBM i / System i (RPG400-L) mailing
list To post a message email: RPG400-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
or email: RPG400-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/rpg400-l.
As an Amazon Associate we earn from qualifying purchases.
This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.
midrange.com
