Title:
Security Analyzer False Positive on #DateFormat(now())# and certain other built-in functions.
| View in TrackerStatus/Resolution/Reason: Closed/Fixed/
Reporter/Name(from Bugbase): Peter Freitag / Peter Freitag (Peter Freitag)
Created: 03/09/2016
Components: Security Analyzer
Versions: 2016
Failure Type:
Found In Build/Fixed In Build: Beta2_v31 /
Priority/Frequency: Normal / Most users will encounter
Locale/System: English / Mac All
Vote Count: 0
Problem Description: Treats #DateFormat(now())# as SQL injection in a query, though it is safe.
Steps to Reproduce: Create a file with the following and run security analyzer:
<cfquery name="test_dateformat">
SELECT * FROM news
WHERE d > '#DateFormat(now(), "yyyy-mm-dd")#'
</cfquery>
Actual Result: Flags as SQL Injection
Expected Result: Does not flag as SQL Injection. The tricky part of this case is if the date mask was from an untrusted variable it could possibly be SQL Injection - but should be ignored if the mask is a static string value.
Any Workarounds: n/a
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 4126413
External Customer Info:
External Company: Foundeo Inc.
External Customer Name: Peter Freitag
External Customer Email: PETE@FOUNDEO.COM
External Test Config:Attachments:
Comments: