[FINERACT-1156] SQL injection error with Run Reports

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.5.0
• Assignee: Manthan Surkar
• Reporter: Manthan Surkar
• Created: 22/Sep/20 20:03
• Updated: 14/Mar/21 10:26
• Resolved: 14/Mar/21 10:26

Description

As reported by Matt
He faced the SQL injection error while trying to run reports for Active Loans (Pentaho).

After investigating a bit, I found all the report names that had a "(" faced this issue, this turns out to be a problem with the regex that was designed to accept the report names.

Unrelated:
This module has a lot of SQL string concatenation and a good place to use our SQLbuilder module ( I will take this)

Issue Links

• Blocked: FINERACT-1305 Release Apache Fineract v1.5.0
• links to: GitHub Pull Request #1344