[FINERACT-1338] SQL Injection - While "runreports" api is trying to load report parameters

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Resolved
• Assignee: Francis Guchie
• Reporter: Francis Guchie
• Created: 31/Mar/21 15:53
• Updated: 01/May/21 08:00
• Resolved: 04/Apr/21 22:09

Description

After solving the error at FINERACT-1336 a new error shows up. 

while api - runreports
fineract-provider/api/v1/runreports/OfficeIdSelectOne?parameterType=true
is spooling the report parameters, user will not see any error on the UI 

but looking through the console OR postman you see error below

{     "developerMessage": "The request was invalid. This typically will happen due to validation errors which are provided.",     "httpStatusCode": "400",     "defaultUserMessage": "Unexpected SQL Commands found",     *"userMessageGlobalisationCode": "error.msg.found.sql.injection"* }

Issue Links

• incorporates: FINERACT-969 Run OWASP zaproxy.org against Fineract (e.g. fineract.dev)
• is fixed by: FINERACT-1345 Fix runreports
• is part of: FINERACT-854 Use prepared statements instead of string concatenated SQL everywhere