Query String Injection: Android Provider

Constructing a SQLite query statement that contains user input can allow an attacker to view unauthorized records.

Query string injection vulnerabilities occur when:
1. Data enters a program from an untrusted source.



In this case Fortify Static Code Analyzer could not determine that the source of the data is trusted.

2. The data is used to dynamically construct a SQLite query.

The SQLite query string injection allows malicious users to view unauthorized records, but does not allow them to alter the state of the database in any way.

Example 1: The following code dynamically constructs and executes a SQLite query that searches for invoices associated with a customer and a user-specified product category. The user can also specify the column by which the results should be sorted. Assume that the program has already properly authenticated and set the value of customerID prior to this code segment.

  ...
  productCategory = this.getIntent().getExtras().getString("productCategory");
  sortColumn = this.getIntent().getExtras().getString("sortColumn");
  customerID = getAuthenticatedCustomerID(customerName, customerCredentials);
  c = invoicesDB.query(Uri.parse(invoices), columns, "productCategory = '" + productCategory + "' and customerID = '" + customerID + "'", null, null, null, "'" + sortColumn + "'asc", null);
  ...
  

The query that this code intends to execute looks like:

  select * from invoices
  where productCategory = 'Fax Machines'
  and customerID = '12345678'
  order by 'price' asc
  

However, the query is constructed dynamically by concatenating a constant base query string and a user input string productCategory. So the query behaves correctly only if productCategory and sortColumn do not contain single-quote characters. If an attacker provides the string "Fax Machines' or productCategory = \"" for productCategory, and the string "\" order by 'price" for sortColumn, then the query becomes:

  select * from invoices
  where productCategory = 'Fax Machines' or productCategory = "'
  and customerID = '12345678'
  order by '" order by 'price' asc
  

or, in a more readable form,

  select * from invoices
  where productCategory = 'Fax Machines'
  or productCategory = "' and customerID = '12345678' order by '"
  order by 'price' asc
  

These inputs allow an attacker to bypass the required authentication for customerID and allows the attacker to view invoice records matching 'Fax Machines' for all customers.