Sonarqube does not detect Security Hostpot: Formatting SQL queries is security sensitive

Ioritz1993 · March 1, 2023, 6:12pm

Hi!

I have carried out an analysis on a project that has the following code:

It does not detect any vulnerabilities or any security hostpots. The next rule, shouldn’t it test positive?

Below is the project information and the versions of sonarqube and sonarscanner used.

Language: C#
Use: Sonarqube community 9.9.0.65466
SonarScanner for MSBuild 5.8

Thank you very much in advance,
Ioritz

Colin · March 2, 2023, 3:59pm

Hey there.

Thanks for the report. In the future, please provide a text-based snippet of code, rather than a screenshot.

Are you using Microsoft.Data.SqlClient? There’s a known false-negative tracked here: FN S2077: Add support for Microsoft SqlClient Data Provider for SQL Server · Issue #6205 · SonarSource/sonar-dotnet · GitHub

Ioritz1993 · March 3, 2023, 3:22pm

Thank you very much for your response, Colin.

I forgot to include the code in the text. I am attaching a Github repository with the vulnerability commented. The vulnerability is located between lines 73-100.

github.com

ioritz1993/VulnerabilityAPI/blob/main/VulnerabilityAPI/Controllers/SQLInjectionController.cs

using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Data.SqlClient;
using System.Data;
using System.Text.RegularExpressions;
using VulnerabilityAPI.Models;
using static Microsoft.EntityFrameworkCore.DbLoggerCategory.Database;

namespace VulnerabilityAPI.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    public class SQLInjectionController : Controller
    {
        private string _cadena;

        public SQLInjectionController(IConfiguration configuration)
        {
            _cadena = configuration.GetConnectionString("DefaultDatabase");
        }

This file has been truncated. show original

I am using the Microsoft.Data.SqlClient library. It seems that there is a false negative reported for that library. Hopefully, they will fix it as soon as possible.

Thanks again!

Topic		Replies	Views
SQL Injection security hotspot not caught by SonarQube Visual Studio csharp , scanner , visualstudio , dotnet , bug-no-category	8	5540	November 20, 2019
Enterprise edition not picking up sql injection SonarQube Server / Community Build csharp , security	9	2930	January 28, 2020
Not detecting code with potential for sql injection SonarQube Server / Community Build csharp , security	9	1801	August 27, 2021
C# SQL injection not detected SonarQube Cloud csharp , security , false-negative , sonarqube-cloud	5	1827	July 14, 2020
Sonarqube does not identify sql injection Report False-positive / False-negative... csharp , false-negative	3	1287	June 2, 2021

Sonarqube does not detect Security Hostpot: Formatting SQL queries is security sensitive

Related topics