diff --git a/src/main/java/demo/security/servlet/HomeServlet.java b/src/main/java/demo/security/servlet/HomeServlet.java index fac56e5c..fdbd1f39 100644 --- a/src/main/java/demo/security/servlet/HomeServlet.java +++ b/src/main/java/demo/security/servlet/HomeServlet.java @@ -27,6 +27,7 @@ protected void doGet(HttpServletRequest request, out.close(); } + @Override protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { // TODO Auto-generated method stub diff --git a/src/main/java/demo/security/servlet/Insecure.java b/src/main/java/demo/security/servlet/Insecure.java index ebda03fe..f692b5e1 100644 --- a/src/main/java/demo/security/servlet/Insecure.java +++ b/src/main/java/demo/security/servlet/Insecure.java @@ -9,6 +9,7 @@ import java.security.NoSuchAlgorithmException; import java.sql.Connection; import java.sql.ResultSet; +import java.sql.SQLException; import java.sql.Statement; import javax.servlet.http.Cookie; @@ -32,7 +33,7 @@ public void badFunction(HttpServletRequest request) throws IOException { Files.exists(Paths.get("/tmp/", obj)); } - public String taintedSQL(HttpServletRequest request, Connection connection) throws Exception { + public String taintedSQL(HttpServletRequest request, Connection connection) throws SQLException { String user = request.getParameter("user"); String query = "SELECT userid FROM users WHERE username = '" + user + "'"; Statement statement = connection.createStatement(); @@ -40,12 +41,12 @@ public String taintedSQL(HttpServletRequest request, Connection connection) thro return resultSet.getString(0); } - public String hotspotSQL(Connection connection, String user) throws Exception { - Statement statement = null; - statement = connection.createStatement(); - ResultSet rs = statement.executeQuery("select userid from users WHERE username=" + user); - return rs.getString(0); - } + public String hotspotSQL(Connection connection, String user) throws SQLException { + Statement statement = null; + statement = connection.createStatement(); + ResultSet rs = statement.executeQuery("select userid from users WHERE username=" + user); + return rs.getString(0); + } // -------------------------------------------------------------------------- // Custom sources, sanitizer and sinks example diff --git a/src/main/java/demo/security/util/DBUtils.java b/src/main/java/demo/security/util/DBUtils.java index 2f1aca62..8870fcaf 100644 --- a/src/main/java/demo/security/util/DBUtils.java +++ b/src/main/java/demo/security/util/DBUtils.java @@ -7,8 +7,12 @@ import java.sql.*; import java.util.ArrayList; import java.util.List; +import java.util.logging.Level; +import java.util.logging.Logger; public class DBUtils { + private static final Logger LOGGER = Logger.getLogger(DBUtils.class.getName()); + Object value; Connection connection; @@ -79,12 +83,6 @@ public void sumNumbers(int max) { count = 0; for (int i = 2; i <= number / 2; i++) { if (number % i == 0) { - for (int m = 2; i <= number / 2; i++) { - if (number % m == 0) { - count++; - break; - } - } count++; break; } @@ -93,7 +91,9 @@ public void sumNumbers(int max) { sum = sum + number; } } - System.out.println("The Sum of numbers is: " + sum); + if (LOGGER.isLoggable(Level.INFO)) { + LOGGER.info("The Sum of numbers is: " + sum); + } } /**