Status/Resolution/Reason: Closed/Fixed/
Reporter/Name(from Bugbase): Jason Dean / Jason Dean (Jason Dean)
Created: 03/09/2016
Components: Security Analyzer
Versions: 2016
Failure Type: Unspecified
Found In Build/Fixed In Build: Alpha3_v31 /
Priority/Frequency: Normal / Unknown
Locale/System: English / Win All
Vote Count: 0
Problem Description:
This code should be flagged for SQLi, it is not.
component {
public function getUserByID( numeric id ) {
var q = new Query( );
q.setDataSource( "MyDSN" );
q.setName( "user" );
q.setSql( "SELECT username, password FROM users WHERE userid = #ARGUMENTS.id#" );
var result = q.execute( );
return result;
}
}
Steps to Reproduce:
1. Paste code into file
2. Run code analyzer
Actual Result:
No warning
Expected Result:
Flagged for SQLi vulnerablity
Any Workarounds:
None
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 4126537
External Customer Info:
External Company: MDH
External Customer Name: Jason Dean
External Customer Email: JASON@12ROBOTS.COM
External Test Config:Attachments:
Comments: