Is Spring Data JPA safe against SQL injection

Question

I am trying to find information about Spring Security JPA and if methods like .save() are protected from sql injection.

For instance I have object Customer. that I want to persist to my database. I am using CustomerRepository Spring implementation to operate on that entity. Customer's constructor is using parameters from the user. When everything is staged I am invoking .save(). Is this safe against sql injection or Should I do the check up first?

Carlos · Accepted Answer · 2021-07-12 19:57:21Z

21

.save() is safe, only the usage of native queries is vulnerable.

List results = entityManager.createNativeQuery("Select * from Customer where name = " + name).getResultList();

You can make native queries safe also, if you use a parameter.

Query sqlQuery = entityManager.createNativeQuery("Select * from Customer where name = ?", Customer.class);
List results = sqlQuery.setParameter(1, "John Doe").getResultList();

edited Jul 12, 2021 at 19:57

Carlos

1,1761 gold badge7 silver badges23 bronze badges

answered Jan 15, 2017 at 12:45

jklee

2,2782 gold badges18 silver badges27 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Dago Over a year ago

so for instance if Customer object has field name, and it is set to be a string: Select * from Customer where name = 'test' and i use save() method, nothing wrong with table wiill happen?

jklee Over a year ago

The JDBC driver will escape this data appropriately before the query is executed;

Cosmin Oprea Over a year ago

The problem here is when String name = "'Cosmin' or name='Jhon'"

fatih yavuz Over a year ago

is CrudRepository methods like .save() .delete() is safe for sql injection ?

Dan Ortega Over a year ago

@jklee Do you have a reference of your argument, it seems to be hard to find it.

Collectives™ on Stack Overflow

Is Spring Data JPA safe against SQL injection

1 Answer 1

5 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related