Umthelela Womjovo we-SQL
Umjovo we-SQL (SQLi) uvumela umhlaseli ukuthi aphazamise imibuzo eyenziwa uhlelo lokusebenza kusizindalwazi salo [S1]. Umthelela oyinhloko uhlanganisa ukufinyelela okungagunyaziwe kudatha ebucayi njengamaphasiwedi omsebenzisi, imininingwane yekhadi lesikweletu, nolwazi lomuntu siqu [S1].
Ngale kokwebiwa kwedatha, abahlaseli ngokuvamile bangashintsha noma basuse amarekhodi esizindalwazi, okuholela ezinguqukweni eziqhubekayo ekuziphatheni kohlelo lokusebenza noma ekulahlekeni kwedatha [S1]. Ezimweni ezinobunzima obuphezulu, i-SQLi ingakhushulwa ukuze kufakwe engcupheni ingqalasizinda engemuva, inike amandla ukuhlaselwa kokuphika isevisi, noma inikeze umnyango ongemuva oqhubekayo ezinhlelweni zenhlangano [S1][S2].
Imbangela: Ukuphatha okokufaka okungaphephile
Imbangela eyinhloko yomjovo we-SQL ukungathathi hlangothi okungafanele kwezinto ezikhethekile ezisetshenziswe kumyalo we-SQL [S2]. Lokhu kwenzeka lapho uhlelo lokusebenza lwakha imibuzo ye-SQL ngokuhlanganisa okokufaka okuthonywe ngaphandle ngokuqondile kuyunithi yezinhlamvu zombuzo [S1][S2].
Ngenxa yokuthi okokufaka akuhlukanisiwe kahle nesakhiwo sombuzo, umhumushi wesizindalwazi angase asebenzise izingxenye zokufakwayo komsebenzisi njengekhodi ye-SQL esikhundleni sokukuthatha njengedatha engokoqobo [S2]. Lokhu kuba sengozini kungabonakala ezingxenyeni ezihlukahlukene zombuzo, okuhlanganisa izitatimende SELECT, INSERT amanani, noma UPDATE izitatimende [S1].
Ukulungisa Nokuncishiswa Ukhonkolo
Sebenzisa Imibuzo Enepharamitha
Indlela ephumelela kakhulu yokuvimbela umjovo we-SQL ukusetshenziswa kwemibuzo enepharamitha, eyaziwa nangokuthi izitatimende ezilungiselelwe [S1]. Esikhundleni sokuhlanganisa amayunithi ezinhlamvu, onjiniyela kufanele basebenzise izindlela ezihlelekile eziphoqelela ukuhlukaniswa kwedatha nekhodi [S2].
Isimiso Selungelo Elincane
Izinhlelo zokusebenza kufanele zixhume kusizindalwazi zisebenzisa amalungelo aphansi adingekayo emisebenzini yazo [S2]. I-akhawunti yesicelo sewebhu akufanele ibe namalungelo okuphatha futhi kufanele ikhawulelwe kumathebula athile noma imisebenzi edingekayo emsebenzini wayo [S2].
Ukuqinisekisa Okokufaka kanye Nombhalo Wekhodi
Nakuba kungekona ukumiselela ipharamitha, ukuqinisekiswa kokokufaka kunikeza ukuvikela okujulile [S2]. Izinhlelo zokusebenza kufanele zisebenzise isu elamukelekayo elaziwayo, eliqinisekisa ukuthi okokufaka kufana nezinhlobo ezilindelekile, ubude, namafomethi [S2].
I-FixVibe iyihlolela kanjani
I-FixVibe isivele ihlanganisa umjovo we-SQL ngemojuli yesithwebuli esiyi-active.sqli esisangweni. Ukuskena okusebenzayo kuqala kuphela ngemva kokuqinisekiswa kobunikazi besizinda kanye nobufakazi. Isheke licaca amaphoyinti okugcina we-GET anemvelaphi efanayo namapharamitha wombuzo, lisungula impendulo eyisisekelo, libheka okudidayo kwe-boolean eqondene ne-SQL, futhi libika kuphela okutholakele ngemva kokuqinisekiswa kwesikhathi kubo bonke ubude bokulibaziseka obuningi. Ukuskena kwekhosombe kuphinde kusize ukubamba imbangela yangaphambili nge-code.web-app-risk-checklist-backfill, ehlaba umkhosi izingcingo ze-SQL ezingavuthiwe ezakhiwe ngokutolikwa kwesifanekiso.