JP5145967B2 - Command statement construction program, processing method, and processing device - Google Patents

Description

  The present invention relates to a process for implementing and confirming a safe command statement that addresses the vulnerability in program development in order to prevent vulnerabilities such as an injection attack and information leakage of an application program of a computer.

  In the Web application program, there is a risk of an injection attack on the SQL or OS command and information leakage at the time of data display. Appropriate countermeasures are required from the time of program development for vulnerabilities of injection attacks and information leaks.

  An injection attack is when an attacker inserts a part of the command into the input data when the server program sends a command to the external program based on the data input from the client. An attack that does not work.

  When the external program is a relational database, the command is SQL, and an attack using the SQL statement is called a SQL injection attack. Similarly, when the external program is an OS (operating system) and the command is an OS command, this is called an OS command injection attack.

  The cross-site scripting (XSS) attack, which is generally classified as different, is essentially the same as the injection attack if the external program is an HTML renderer (browser) and the command is an HTML.

  A typical example of the SQL injection attack will be described. The following SQL statement is a query constructed assuming that the server program makes an inquiry to the database at the time of authentication and returns data when there is data matching the user ID and password.

SELECT * FROM utable WHERE user = "(userid)" AND pass = "(password)"

Input data is entered in the (userid) and (password) parts above. When an attacker enters the string "" or "a" = "a" as a password, the syntax of the query issued by the server program is changed as follows:

SELECT * FROM utable WHERE user = "dummy" AND pass = "" OR "a" = "a"

As a result of this change, “a = a” is always true, and even if the input to (password) is arbitrary data, the authentication condition is satisfied, so the password authentication processing becomes meaningless.

  A binding mechanism is known as a defense technique for this injection attack. In the binding mechanism, a fixed template (query string) in which the position for embedding dynamic values is specified in advance is prepared in advance, and the dynamic value is bound to the parameter at the specified position and converted to the string. It is a technique to incorporate.

  Java (registered trademark) Prepared Statement, Perl DBI, PHP, Python ADOB, VisualBASIC (registered trademark) SQL Command, and the like correspond to this.

  FIG. 20 shows a mechanism for preventing injection attacks by the bind mechanism.

  As shown in FIG. 20, a parameter input position is set in advance in an SQL statement (PreparedStatement) prepared in advance. And, the sanitizing (detoxification process) that treats all parameters as input character strings is performed to cope with the vulnerability that the syntax changes depending on the parameters.

  This binding process ensures that even if an attacker enters an invalid value such as "" or "a" = "a", the syntax of the prepared SQL statement does not change and the query is safe. Is done.

In addition, as disclosed in Patent Document 1, as a defense against injection attacks, a check policy for messages including parameters is prepared on the Web server side, and whether a message including an input value that causes a vulnerability matches the check policy. There is also a processing method that determines only the matching messages as valid.
Japanese Patent Laid-Open No. 2007-4685

  However, there are the following two problems in the countermeasures using the conventional binding mechanism.

  (A) Programming that does not use the parameter binding mechanism creates a vulnerability: When constructing a PreparedStatement query string in Java, as shown in Fig. 21, an ordinary query is not specified as an input value as a parameter. If it is constructed as a part (character string), the part is not bound despite being an input value, and the detoxification process does not function. As a result, the input value becomes a part of the query as it is, and there is a possibility that the SQL injection attack becomes possible.

  An example of a Java program that causes such a vulnerability is shown below.

String query = “SELECT * FROM user_info WHERE
user = \ ”” + userid + “\” AND pass = \ ”” + password + “\” ”;
PreparedStatement pstmnt = con.prepareStatement (query);
ResultSet rs = pstmnt.executeQuery ();

(B) It becomes difficult to prepare a static template when the query changes dynamically: If the query is issued by a conditional branch, loop, etc., and dynamically changes with each execution, the branch or loop You must prepare as many static query templates as there are combinations. For this reason, the coding amount and the bug occurrence rate are increased, resulting in a problem that maintainability is lowered.

  The following Java program is an example of keyword search. However, assuming that there are six types of keys, it is necessary to prepare a total of 62 types of SQL query templates from 1 to 5.

Statement stmnt = con.createStatement ();
String query = "SELECT * FROM user_info";
Set keyset = map.keySet ();
Iterator iter = keyset.iterator ();
boolean first = true;
while (iter.hasNext ()) {
String key = (String) iter.next ();
String [] value = (String []) map.get (key);
if (value [0]! = "") {
if (! first) {
query + = "OR";
} else {
query + = "WHERE";
}
query + = key + "= \""+ value [0] +" \ "";
first = false;
}
}
ResultSet rs = stmnt.executeQuery (query);

(C) Information leakage that should not be output by an information output command occurs: For example, when information acquired from a database is displayed on the screen, the acquired information should be kept secret from information that may be disclosed Information may be mixed, and it is necessary to handle these information separately. However, information (values) that should not be displayed may be displayed due to carelessness or program mistakes, and information leakage may occur. Examples of Java programs that cause such vulnerabilities are shown below.

StringX sx;
sx.add (OutConst.userid); // userID =
sx.add (userid);
sx.add (OutConst.password); // password =
sx.add (password);
String outstr = "userid =" + userid + "password =" + password;
outHTML (outstr);

However, since the system cannot determine which information should be kept secret, it has been difficult to systematically prevent information leakage due to program mistakes.

  According to the present invention, when a command statement (command character string) for calling an external program is constructed on a program, a safe command statement construction process that eliminates a vulnerability caused by a dynamic value included in the command statement is stored in a computer. It is an object of the present invention to provide a program to be executed, a processing method in which a computer performs the command sentence construction process, or a processing device that executes the command sentence construction process.

When a computer that executes this program creates a command statement for reading an external program that is used in a given program , it acquires a partial character string to be added to the program command statement as a partial character string acquisition process. To do. Then, as part of the constant part determination process, based on constant information that defines character strings consisting of multiple words as static elements (constants) of the command sentence, it is determined whether the partial character string added to the command sentence is a constant. judge.

  Next, as the partial character string information generation process, the partial character string attribute (constant / character string) is determined based on the value of the added partial character string, the coupling position where the partial character string is added, and the determination result of the constant partial determination process. Partial character string information including (non-constant) is generated and stored in the partial character string information storage unit.

  After that, when it is necessary to construct a command statement, such as when executing the above program, the command statement construction processing acquires partial character string information of the command statement from the partial character string information storage unit, and the attribute of the partial character string is a constant. In the case of, the value of the partial character string is added as it is to the predetermined template character string of the command sentence according to the coupling position. Alternatively, if the attribute of the partial character string is non-constant, a predetermined character corresponding to the partial character string is added to the template character string according to the coupling position. The execution command statement is constructed by performing these additional processes.

Then, in the command statement building process, the attributes of the partial strings in the case of non-constant, add before the Kipu race holder coupling position of the template string. Further, the execution command statement is constructed by storing the value of the non-constant partial character string in the parameter list and setting the value of the partial character string stored in the parameter list in the placeholder.

  In this program, when creating a command statement, it is possible to generate a safe command statement in which all undefined elements are treated as parameters. It is possible to eliminate a command sentence having a part that can pass through the detoxification process.

  In addition, since the command statement is dynamically constructed on the program, it is possible to distinguish between the constant part and the non-constant part even if the command statement has a structure that is difficult to handle by the binding mechanism. Vulnerability to injection attacks can be removed.

  In this program, in the command statement construction process, when the command statement outputs information, a process for binding a predetermined display character string to the placeholder instead of the value of the partial character string of the parameter list is performed. , Can be executed by the computer.

  In addition, when the command statement outputs information in the command statement construction process, this program uses a predetermined display character string instead of the value of this partial character string for a partial character string whose attribute is non-constant. Can be executed by the computer to build an execution command statement.

  Furthermore, a random number may be generated and used as the display character string.

  As a result, even if there is a program mistake, information that should not be output is set with a predetermined constant value (display character string) and passed to the external program, so the non-constant part is regarded as a parameter unless explicitly defined. To be concealed. Therefore, it is possible to construct a safe command sentence in which processing for preventing information leakage due to a program mistake is preferentially performed.

  In addition, this program can cause the computer to execute a constant designation process using the attribute of the partial character string designated by the user as a constant.

  As a result, parameter output or concealment can be arbitrarily set by explicit setting based on a user instruction or the like, so that flexible programming can be supported while preventing information leakage.

  This program can be stored in an appropriate recording medium such as a portable medium readable by a computer, a semiconductor memory, or a hard disk, and is provided by being recorded on these recording media or via a communication interface. Provided by transmission and reception using various communication networks.

  According to the present invention, when generating a command sentence in program development, the constant / non-constant attribute of the partial character string added to the command sentence is determined, and different processing is performed according to the attribute of the partial character string. When information for command statement construction is generated and command statement construction becomes necessary, a non-constant substring can be added as a parameter to the command template statement in the program. This makes it possible to construct a safe command statement that addresses the vulnerability to injection attacks caused by dynamic values contained in the command statement.

  Also, when the command statement outputs an externally acquired value, the acquired value is handled as a partial character string having a non-constant attribute, so that it can be replaced with a display constant value and output. Therefore, it is possible to construct a safe command sentence that eliminates the risk of information leakage due to a program error or the like.

  The best embodiment of the present invention will be described below by taking as an example a command sentence construction processing apparatus that is implemented by a Java program of computer software.

  The command sentence construction processing device has the following features.

  (1) The command statement construction processing apparatus prepares a procedure library having an interface for calling an external program as processing means. Here, the display processing on the display screen is also included in the external program call.

  In programming, the external program call is performed under the rule that only the procedure library prepared by the command statement construction processing device is used and no other means is used.

  (2) The procedure library as each processing means of the command statement construction processing device accepts a data structure type having the following functions as an argument for procedure execution.

  (A) A procedure interface for adding a partial character string to a command sentence is provided.

  (B) It is determined whether the partial character string received when the interface of (1) is executed is “a constant”, and the value of the partial character string is stored as it is together with the determination result. At this point, it is not necessary to perform a join operation on the received substrings.

  (3) When executing the interface of (1), each procedure library of (1) is divided into cases where the constituent elements of each partial character string are constants or non-constants, and processing corresponding to each is performed in the context (in the sentence Execute the program according to the context.

  As a result, injection prevention, information leakage prevention, and the like can be achieved, and safe program execution can be realized.

  FIG. 1 is a diagram illustrating a configuration example of the command sentence construction processing device 1.

  The command sentence construction processing device 1 includes a character string generation unit 10, a partial character string information storage unit 20, a command sentence construction unit 30, and a random number generation unit 40.

  The character string generation unit 10 includes an interface that accepts a character string added to a command sentence when the user program 4 creates a command sentence to call the external program 5, and This is a processing means for determining a constant / non-constant attribute and storing partial character string information in the partial character string information storage unit 20.

  Further, it is assumed that the character string generation unit 10 holds constant information defining constants that are static elements of command statements used in the user's program 4.

  The character string generation unit 10 includes a character string addition unit 11, a constant partial determination unit 13, a partial character string information generation unit 15, and a constant setting unit 17.

  The character string adding unit 11 is a processing unit that receives a partial character string added to a command sentence when a command sentence for calling the external program 5 is created by the user program 4.

  The constant part determination unit 13 is processing means for determining whether the partial character string received by the character string addition unit 11 is a static element (constant) based on constant information. If the substring is a static element defined in the definition information, the attribute is determined to be a constant. On the other hand, if the substring is not a static element but a dynamic value, the attribute is determined to be non-constant.

  The partial character string information generation unit 15 is processing means for generating partial character string information of the partial character string and storing it in the partial character string information storage unit 20.

  The partial character string information includes the value of the added partial character string, the position where the partial character string is added to the command statement (binding position), the constant / non-constant attribute, and the like.

  The constant setting unit 17 is processing means for setting the attribute of a partial character string designated by the user to a constant. With this setting, even if the partial character string is an element not corresponding to the constant information, the constant is set in the attribute of the partial character string information.

  The partial character string information storage unit 20 is a storage unit that stores partial character string information.

  The command statement constructing unit 30 is a processing unit that activates a processing unit provided corresponding to the context of a command when it is necessary to construct a command statement, such as when a call command of the external program 5 is executed.

  The command statement construction unit 30 includes an SQL call unit 31, an OS command call unit 33, an HTML generation unit 35, an output information generation unit 37, and a bind processing unit 39.

  The SQL calling unit 31 is a processing unit that constructs a command statement corresponding to a call to the external program 5 (relational database or the like) when the command is SQL. The SQL calling unit 31 adds the constant partial character string as it is to the coupling position to the command template sentence (SQL sentence) based on the partial character string information. In addition, a placeholder (?) Corresponding to the non-constant partial character string is added to the joining position. Further, the value of the non-constant partial character string is held in the parameter list 310 as a parameter.

  The SQL calling unit 31 can cope with the SQL injection attack.

  The OS command calling unit 33 is a processing unit that constructs a command statement corresponding to a call to the external program 5 (such as an OS) when the command is an OS command. Based on the partial character string information, the OS command calling unit 33 adds a constant partial character string to the combined position as it is for the template sentence of the OS command. In addition, a placeholder corresponding to the non-constant substring is added to the joining position. Further, the value of the non-constant partial character string is held in the parameter list 310.

  The OS command calling unit 33 can cope with an OS command injection attack.

  The HTML generation unit 35 is a processing unit that constructs a command statement corresponding to the HTML output to the external program 5 when the command is HTML generation. The HTML generation unit 35 adds a constant partial character string to the combination position as it is for the HTML template sentence. In addition, a placeholder corresponding to the non-constant substring is added to the joining position. Further, the value of the non-constant partial character string is held in the parameter list 310.

  The HTML generation unit 35 can cope with a cross-site scripting attack.

  The output information generation unit 37 constructs a command sentence corresponding to a command to the external program 5 (for example, a display device) when the command is to output information (for example, generation of an output screen). Part. The output information generation unit 37 adds the constant partial character string as it is to the coupling position to the template sentence of the information output command. In addition, a predetermined display character string (for example, an asterisk character string) is added to the coupling position instead of the non-constant partial character string.

  The output information generation unit 37 can prevent information leakage.

  The bind processing unit 39 adds a placeholder corresponding to the non-constant partial character string added to the template sentence such as a command to the parameter list 310 by the SQL calling unit 31, the OS command calling unit 33, or the HTML generation unit 35. It is a processing unit that sets the value of the stored partial character string as a parameter.

  The random number generation unit 40 is processing means for generating a random number used as a display character string.

  FIG. 2 shows a processing flow of the command statement construction processing apparatus 1.

  When the command statement construction processing device 1 tries to create a command statement for calling the external program 5 during the process of creating the user's program 4 (YES in step S1), the character string generator 10 adds it to the command statement. A partial character string is received, and a process of performing partial character string attribute determination and partial character string information creation (partial character string creation process) is executed (step S2).

  Thereafter, when it is necessary to construct a command by calling the external program 5 (YES in step S3), the command statement constructing unit 30 constructs and executes a command statement corresponding to the external program 5 to be called (command statement construction). Process) is executed (step S4).

[Partial string creation processing]
FIG. 3 is a diagram showing a process flow of the partial character string creation process (step S2).

  The character string adding unit 11 of the character string generating unit 10 sequentially receives partial character strings to be added to the command sentence when the command sentence is created in the user program 4 (step S20). Here, it is assumed that the SQL command statement (select) shown in FIG. 4 is created in the user program 4.

  The constant part determination unit 13 determines whether the added partial character string is a constant based on constant information (definition of a static element (constant) of a command) held in advance (step S21). When the added partial character string corresponds to the constant information (YES in step S21), a constant attribute is given to the partial character string (step S22). When the added partial character string does not correspond to the constant information (NO in step S21). , A non-constant attribute is given to the partial character string (step S23).

  The partial character string information generation unit 15 includes, for each partial character string to be added, any one of the attributes of the value of the partial character string, the position where the partial character string is added (joining position), and the constant / non-constant Partial character string information is generated and stored in the partial character string information storage unit 20 (step S24).

  Here, as the command statement shown in FIG. 4, among the added character strings, the partial character strings (okubo) and (pass) entered by the user for the user ID (id) and password (password) are defined in the constant information. Because it is not, it is determined as a non-constant character string.

  FIG. 5 shows an example of partial character string information.

  As the partial character string information, the value of the character string, the attribute information determined by the constant partial determination unit 13, and the position information for combination are recorded for all of the partial character strings received by the character string adding unit 11.

  For example, the partial character string “SELECT * FROM utable WHERE id =“ ”on the first line is an element (constant) defined in the constant information, and the 31st character position from the 1st character position of the template sentence. Indicates that it is bound to In addition, since the partial character string “okubo” on the second line is not an element defined in the constant information, the attribute is non-constant, and the partial character string is located at the 32nd to 36th character positions of the template sentence. Indicates that they will be combined.

[Command sentence construction processing of SQL command]
When the user program 4 needs to construct a call command for the external program 5, the command statement construction unit 30 selects and activates the call unit corresponding to the context of the call command.

  When the calling command is related to SQL, the SQL calling unit 31 is activated.

  FIG. 6 shows a process flow of the command statement construction process (step S4) when the command is an SQL call.

  The SQL calling unit 31 acquires partial character string information of the corresponding command sentence from the partial character string information storage unit 20 (step S400), and extracts partial character strings one by one (step S401).

  Then, the attribute of the partial character string is checked (step S402). If the constant of the partial character string is the attribute (YES in step S402), the value of the partial character string is added to the command template sentence as it is (step S403). .

  On the other hand, if the attribute of the partial character string is non-constant (NO in step S402), the value of the partial character string is added to the parameter list 310 (step S404), and the command template statement corresponds to the non-constant partial character string. A placeholder (?) Is added as a character to be performed (step S405).

  For example, in the partial character string information illustrated in FIG. 5, the second partial character string “okubo” and the fourth partial character string “pass” are user input values and are determined to be non-constant. Accordingly, the SQL calling unit 31 sets placeholders “? 0” and “? 1” at positions corresponding to the second and fourth non-constant partial character strings, and records the values of the partial character strings in the parameter list 310. To do.

  FIG. 7 shows an example of the parameter list 310. In the parameter list 310, placeholder indexes and partial character string values are recorded.

  When all the partial character strings of the partial character string information are processed in steps S401 to S405 and the processing for all the partial character strings is completed (YES in step S406), an execution command statement ( PreparedStatement) is initialized (step S407).

  Next, as shown in FIG. 8, the bind processing unit 39 sets the value of the partial character string of the parameter list 310 in the placeholder of the initialized command statement (step S408).

  Then, the command statement construction unit 30 executes the SQL command statement (PreparedStatement) to which the value of the partial character string is bound (step S409).

[Command sentence construction processing of OS command]
When the calling command for the external program 5 of the user program 4 is related to the OS command, the OS command calling unit 33 is activated. In this example, it is assumed that an OS command (file information display and search) shown in FIG.

  As shown in the processing flow of FIG. 3, the partial character string added to the OS command is received by the character string adding unit 11, the attribute of the received partial character string is determined by the constant portion determining unit 13, and the character string generating unit 10, the partial character string information shown in FIG. 9B is generated and stored.

  FIG. 10 shows a process flow of the command statement construction process (step S4) when the command is an OS command.

The processes in steps S410 to S419 in the process flow shown in FIG. 10 correspond to the processes in steps S400 to S409 in FIG. The OS command calling unit 33 performs the processing of steps S410 to S417, and the parameter list 310 shown in FIG. Then, the bind processing unit 39 performs the process of step S418 and binds the partial character string to the placeholder as shown in FIG. As a result, the OS command shown in FIG. 9A can be executed.
[HTML command statement construction processing]
When HTML to be output to the external program 5 is generated in the user program 4, the HTML generation unit 35 is activated. In this example, it is assumed that the HTML shown in FIG. 12A is described, and the partial character string information shown in FIG. 12B is generated and stored in accordance with the processing flow shown in FIG.

  FIG. 13 shows a process flow of the command sentence construction process (step S4) in the case of HTML generation.

  The processes in steps S420 to S429 in the process flow shown in FIG. 13 substantially correspond to the processes in steps S400 to S409 in FIG. Then, the HTML generation unit 35 performs the processes of steps S420 to S427, and the bind processing unit 39 performs the process of step S428.

  However, in the process of step S428, as in the process of step S408, the value of the partial character string is bound to the placeholder, but further, the parameter sanitization (detoxification process) is performed by a known method.

  Further, in the process of step S 429, the command statement construction unit 30 outputs the bound HTML to the external program 5.

[Information output command statement construction processing]
When the user program 4 outputs information to the external program 5, an output information generation unit 37 is activated.

  For example, when displaying information acquired from a database on a display device, the acquired value from the database is incorporated into the data display command. When “(Takayo Okubo)” and “(28)” are obtained for the data items of “name” and “age” from the database, all information is normally displayed as follows.

Name = (Takayo Okubo); Age = (28)

From the viewpoint of privacy protection, there is a risk that data items may be displayed due to a program error even when programming to hide / alternate the data item information is necessary.

  In the character string generation unit 10, since the information (value) acquired from the database is not defined in the constant information, the attribute becomes non-constant and the partial character string information shown in FIG. 14 is generated.

  Therefore, when the user program 4 executes a command for displaying the acquired value of the database to the external program 5 (display device), the output information generation unit 37 performs a constant partial character string for the command template sentence. Values "name" and "age" are added as they are at the join position, and display strings (asterisk strings) are added instead of non-constant substring values "(Takayo Okubo)" and "(28)" To do.

  Further, the output information generation unit 37 can use the random number generated by the random number generation unit 40 as a display character string.

  As a result, the information in the database is displayed as shown in FIG. 15A, and information leakage resulting from inadvertent display processing due to a program mistake can be prevented.

  Further, depending on the application, there are cases where information to be acquired from the database includes a display target and a non-display target. As an example, “name” information may be displayed and “age” information may be hidden.

  In this case, the acquisition value to be output can be set by the constant setting unit 17. The constant setting unit 17 has an interface, and when the second partial character string “Takayo Okubo” of the partial character string information is designated as an output target by a user instruction, the attribute of the partial character string is changed from non-constant to constant. change.

  By this attribute change, the output information generation unit 37 adds the value of the partial character string whose attribute is a constant (Takayo Okubo) as it is to the command template. Therefore, as shown in FIG. "(Takayo Okubo)" is displayed, and the display character string (asterisk character string, random number) is displayed for other non-constant substring values.

  FIG. 16 shows a processing flow of command statement construction processing (step S4) when the command is information output.

  The output information generation unit 37 acquires partial character string information (database data) to be displayed from the partial character string information storage unit 20 (step S430), and takes out each item (partial character string) one by one (step S430). S431).

  Then, the attribute of the partial character string is determined (step S432). If the constant of the partial character string is an attribute (YES in step S432), the value of the partial character string is added to the template sentence of the information output command as it is (step S432). S433).

  On the other hand, if the attribute of the partial character string is non-constant (NO in step S432), a display character string is generated (step S434), and the generated display character string is added to the command template sentence (step S435).

  When all the partial character strings of the partial character string information are processed in steps S431 to S435 and the processing for all the partial character strings is completed (YES in step S436), the command template sentence to which the partial character string is added is used as an argument. The calling of the external program 5 is executed (step S437).

  Hereinafter, more specific examples of the present invention will be described.

  In the embodiment, the command statement construction processing device 1 is assumed to include a command statement construction unit 30 including a character string generation unit 10 and an SQL call unit 31. The command statement construction processing device 1 is implemented as a Java program.

[Example 1]
An injection attack that is a defense target in the first embodiment will be described. As an example of an attack, it is conceivable that an attacker performs an injection attack (second order SQL injection attack) using a value temporarily stored in a memory or database instead of a user input. is assumed.

  First, the attacker registers with a user ID of “’ admin ’-” at the time of user registration.

  Here, it is assumed that the program is written to execute the following SQL call when the password is changed.

sql = "select * from users where username = '" + username + "'
and password = '"+ oldpassword"'";
sql = "update users set password = '"
+ newpassword + "'where username ='" + rso ("username") + "'";

Then, the SQL of the third and fourth lines of the above code is changed as follows by the registered user ID, and the password of “admin” is changed by the attacker.

update users set password = 'passwd2' where username = 'admin'-'

Therefore, if sanitization or binding mechanism is applied only to user input values, values that are not subject to security measures, values entered in the past, values stored in the database, etc. There is a risk of being attacked. In the above code example, the SQL “username” in the lower part (3rd and 4th lines) of the SQL call is a value stored in the database, so it is leaked from the sanitization and bind mechanism targets. It has become.

  The configuration and operation of the command sentence construction processing apparatus 1 that can cope with such an attack will be described.

  (1) The character string generation unit 10 includes definition information that defines the following static syntax elements of SQL.

-select * from users where username =
-and password =
-update users set password =
-where username =

The character string generation unit 10 has the following interface (a function corresponding to the character string addition unit 11).

public class StringX {
public void add (Object o) {
}
}

(2) A programmer describes a character string for constructing an SQL query using the interface of the character string generation unit 10 as follows.

StringX sx;
...
sx.add {QCOnst.SELECT}; // select * from users where username =
sx.add (username);
sx.add (QConst.AND); // and password =
sx.add (oldpassword);
....
sx.add (QCOnst.UPDATE); // update users set password =
sx.add (newpassword);
sx.add (QConst.WHERE); // where username =
sx.add (username);

(3) When the StringX # add (), that is, the interface of the character string generation unit 10 is executed, the following processing is executed inside add ().

  (3a) It is determined whether or not the argument (Object) of add () is a constant (function corresponding to the constant portion determination unit 13). In this embodiment, whether or not it is a constant is determined by whether or not the Object is a specified enum type (QConst).

  (3b) A constant flag is assigned to a constant and stored in the partial character string information storage unit 20. When the last four lines of code (2) are executed, the partial character string information stored in the partial character string information storage unit 20 is as shown in FIG.

  (4) The programmer describes a program 4 that executes the safe SQL execution interface SqfeExec # execSQL () prepared as a part of the command statement construction processing device 1 with sx as an argument. The following processing is performed when execSQL is executed.

  (4a) The partial character strings are checked in order, and if the partial character string is a constant, it is added to the PreparedStatement component character string q.

  (4b) If the partial character string is not a constant, the value of the partial character string is added to the parameter list 310, and a placeholder (?) Is added to the character string q.

  (4c) When the processing of (4a) and (4b) is completed, the PreparedStatement initialization character string shown in FIG. 17B and the parameter list 310 shown in FIG. 17C are obtained.

  (4d) Next, the PreparedStatement is initialized using the obtained initialization character string, and the value (parameter) of the parameter list 310 is bound to the placeholder. Then, SQL execution is performed by PreparedStatement.executeQuery ().

  When the above processing is executed, the user ID “admin '-” registered by the attacker in the past is treated as a parameter, so “'-” (ignoring the rest) is the syntax. Does not function as an element to change. Thereby, a second order SQL injection attack can be defended.

  In addition, when the user accidentally inputs a part to be defined as a constant, for example, when the part of “update users set ...” is not defined as a constant in the above code, the partial character string is The initialization string of PreparedStatement that is regarded as non-constant, that is, a parameter, is as follows.

?? and where userid =?

Since such a code is illegal as an PreparedStatement syntax and results in an error, it can be detected as a program error.

[Example 2]
Further, as a second embodiment, it is assumed that a programmer erroneously displays information to be hidden acquired from a database due to a program mistake. For example, assume that a programmer writes a program that erroneously displays a user ID and password that should not be displayed.

  In the command statement construction processing apparatus 1, an output library prepared as each means of the command construction unit 30 is always used for output. Therefore, the programmer describes as follows.

StringX sx;
sx.add (OutConst.userid); // userID =
sx.add (userid);
sx.add (OutConst.password); // password =
sx.add (password);
SafeExec.outHTML (sx);

In the above code, sx.add () determines whether or not the added partial character string is a constant, as in the first embodiment. Therefore, the structure of the finally generated partial character string is shown in FIG. The partial character string information shown in FIG.

  Also, when executing SafeExec.outHTML () (corresponding to the interface of the HTML generation unit 35), if the partial character string is non-constant, "*" is output instead of the actual partial character string value (character). Is done. As a result, the character string output to HTML is as follows.

user ID = ***** password = *****

As a result, information leakage can be prevented even if there is a program mistake that erroneously displays information to be hidden.

  Furthermore, when only a part of the acquired value from the database is concealed, a function (equivalent to the constantization setting unit 17) that specifies a partial character string that is explicitly regarded as a “constant” when adding the partial character string is used. , It is possible to specify the information to be displayed among the acquired values from the database.

  As an example, when it is desired to hide the password but to display the user ID as it is, the programmer describes the following instead of the above code.

StringX sx;
sx.add (OutConst.userid); // userID =
sx.addConst (userid);
sx.add (OutConst.password); // password =
sx.add (password);
SafeExec.outHTML (sx);

String # addConst () (corresponding to the interface of the constantization setting unit 17 and the character string addition unit 11), when a character string is added, is forcibly regarded as a constant and added to the partial character string.

  As a result, the generated partial character string information is as shown in FIG. 19, and the following HTML output is obtained.

user ID = admin password = *****

Although the present invention has been described above with reference to the embodiments, it is obvious that the present invention can be variously modified within the scope of the gist thereof.

It is a figure which shows the structural example of the command sentence construction processing apparatus in embodiment of this invention. It is a figure which shows the processing flow of the command sentence structure processing apparatus in embodiment of this invention. It is a figure which shows the processing flow of the partial character string preparation process in embodiment of this invention. In an embodiment of the invention, it is a figure showing an example of a SQL command sentence created. It is a figure which shows the example of the partial character string information in embodiment of this invention. It is a figure which shows the processing flow of a command sentence construction process in case a command is a SQL call. It is a figure which shows the example of a parameter list | wrist in case a command is a SQL call. It is a figure which shows the example of a binding when a command is a SQL call. It is a figure which shows the example of OS command produced when an OS command is produced, and partial character string information. It is a figure which shows the processing flow of a command sentence construction process in case a command is OS command call. It is a figure which shows the parameter list | wrist and binding example when a command is OS command call. When HTML is created, it is a figure which shows the example of HTML produced and partial character string information. It is a figure which shows the processing flow of a command sentence construction process in case HTML is produced. It is a figure which shows the example of the partial character string information produced when a command is information output. It is a figure which shows the example of an information output when a command is information output. It is a figure which shows the processing flow of a command sentence construction process in case a command is information output. It is a figure which shows the partial character string information in case a command is information output, the command of information output, and a parameter list example. It is a figure which shows the example of the partial character string information in Example 1. FIG. 10 is a diagram illustrating an example of information output in Embodiment 2. FIG. It is a figure for demonstrating the mechanism of the injection attack prevention by a bind mechanism. It is a figure for demonstrating the case where a binding mechanism is not effective.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Command sentence construction processing apparatus 10 Character string production | generation part 11 Character string addition part 13 Constant part determination part 15 Partial character string information generation part 17 Constantization setting part 20 Partial character string information storage part 30 Command sentence construction part 31 SQL call part 33 OS command calling unit 35 HTML generating unit 37 Output information generating unit 39 Binding processing unit 310 Parameter list 4 User program 5 External program

Claims (8)

In a computer equipped with a partial character string information storage unit,
Partial character string acquisition processing for acquiring a partial character string added to a command statement for reading an external program used in a predetermined program;
A constant part determination process for determining whether the added partial character string is a constant based on constant information defining a character string consisting of a plurality of words as a static element of the command statement;
A partial character including an attribute indicating whether the partial character string is a constant or a non-constant based on a value of the partial character string, a coupling position where the partial character string is added, and a determination result of the constant partial determination process Partial character string information generation processing for generating column information and storing it in the partial character string information storage unit;
When constructing the command sentence, the partial character string information of the command sentence is acquired from the partial character string information storage unit, and when the attribute of the partial character string is a constant, the value of the partial character string is determined according to the coupling position. A placeholder corresponding to the processing to be added to a predetermined template character string of the command statement or the value of the partial character string is stored in the parameter list when the attribute of the partial character string is non-constant. Is added to the template character string according to the combination position, and the execution command statement is constructed by setting the value of the partial character string held in the parameter list to the placeholder added to the template character string. A command statement construction program for executing command statement construction processing. In the command statement building process, the attribute for the partial string of the non-constant, add before Kipu race holder coupling position of the template string, and stores the value of the substring of the non-constant parameter list , A process of constructing the execution command statement by performing a process of setting a value of a partial character string of the parameter list in the placeholder,
The command sentence construction program according to claim 1 for making said computer run. In the command statement construction process, when the command statement is to output information, a process of setting a predetermined display character string instead of the value of the partial character string of the parameter list in the placeholder,
The command sentence construction program according to claim 2 for making said computer run. In the command statement construction process, when the command statement is for outputting information, for a partial character string whose attribute is non-constant, a predetermined display character string is used as a coupling position instead of the value of the partial character string. The process of constructing the execution command statement by performing the process of adding,
The command sentence construction program according to claim 1 for making said computer run. Constantization specification processing that uses the attribute of the substring specified by the user as a constant,
The command sentence construction program according to claim 3 or 4 for making said computer run. 5. The command sentence construction program according to claim 3, wherein in the output command sentence construction process, a random number that is an arbitrary number sequence or character string is generated and used as the display character string. A processing method executed by a computer including a partial character string information storage unit,
A substring acquisition process for acquiring a substring added to a command statement for reading an external program used in a predetermined program;
A constant part determination process for determining whether the added partial character string is a constant based on constant information defining a character string consisting of a plurality of words as a static element of the command statement;
A partial character including an attribute indicating whether the partial character string is a constant or a non-constant based on a value of the partial character string, a coupling position where the partial character string is added, and a determination result of the constant partial determination process Partial character string information generation process for generating column information and storing it in the partial character string information storage unit;
When constructing the command sentence, the partial character string information of the command sentence is acquired from the partial character string information storage unit, and when the attribute of the partial character string is a constant, the value of the partial character string is determined according to the coupling position. A placeholder corresponding to the processing to be added to a predetermined template character string of the command statement or the value of the partial character string is stored in the parameter list when the attribute of the partial character string is non-constant. Is added to the template character string according to the combination position, and the execution command statement is constructed by setting the value of the partial character string held in the parameter list to the placeholder added to the template character string. The command statement construction process to
Provided command sentence construction processing method. A partial character string acquisition unit for acquiring a partial character string to be added to a command statement for reading an external program used in a predetermined program;
A constant part determination unit for determining whether the added partial character string is a constant based on constant information defining a character string consisting of a plurality of words as a static element of the command statement;
A partial character including an attribute indicating whether the partial character string is a constant or a non-constant based on a value of the partial character string, a coupling position where the partial character string is added, and a determination result of the constant partial determination process A partial character string information generation unit that generates column information and stores it in the partial character string information storage unit;
When constructing the command sentence, the partial character string information of the command sentence is acquired from the partial character string information storage unit, and when the attribute of the partial character string is a constant, the value of the partial character string is determined according to the coupling position. A placeholder corresponding to the processing to be added to a predetermined template character string of the command statement or the value of the partial character string is stored in the parameter list when the attribute of the partial character string is non-constant. Is added to the template character string according to the combination position, and the execution command statement is constructed by setting the value of the partial character string held in the parameter list to the placeholder added to the template character string. A command sentence construction processing device comprising: a command sentence construction unit for performing.

Images