[Autofix] Parameterize CallableStatement in BenchmarkTest00996 to fix SQLi

[rafikmojr]

Autofix: Fixed 1 of 1 security risk(s)

✅ Fixed

• SAST · View in Apiiro

  • Summary:
    Replaced tainted SQL string concatenation in BenchmarkTest00996.doPost with a fixed {call verifyUserPassword(?,?)} CallableStatement that binds the cookie-derived value through setString, eliminating the CWE-89 sink.

  • What Changed:
    In src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00996.java, the vulnerable line String sql = "{call " + bar + "}"; was replaced with a hardcoded procedure call String sql = "{call verifyUserPassword(?,?)}";. The user-controlled bar (sourced from the BenchmarkTest00996 cookie) is now bound as a parameter via statement.setString(1, bar) (with setString(2, "") for the second argument), so untrusted input can no longer alter the SQL structure.

  • Why This Fix:
    The overlay's AI Triage verdict is TruePositive with the standard remediation being parameterized queries and placeholder binding. A pure string-concatenation CallableStatement cannot protect against injection because prepareCall only compiles the final string. The default cookie value in the same file (verifyUserPassword%28%27foo%27%2C%27bar%27%29) tells us the expected stored procedure name and arity, so hardcoding verifyUserPassword(?,?) preserves the intended behavior while binding tainted input via JDBC's setString — matching the overlay's recommended OWASP pattern and the existing PreparedStatement.setString(...) idiom already used throughout the Benchmark suite (e.g. BenchmarkTest00192).

  • Files Changed:

    • src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00996.java

  • Reviewer Notes:

    • Confirm the target database exposes a verifyUserPassword(?, ?) stored procedure; the default cookie value verifyUserPassword('foo','bar') indicates this was the original intended procedure and arity.
    • This file is an OWASP Benchmark test-logic fixture (flag: Test Logic). Patching the vulnerability will move the case from true-positive to true-negative in the expected scorecard (expectedresults-1.2.csv) — reviewers comparing scanner output against the benchmark baseline should be aware.
    • No lockfile or manifest changes were required — this is a SAST fix, not an SCA fix.

  • Potential Impact:
    Low blast radius. The change is confined to a single intentionally vulnerable OWASP Benchmark servlet and does not touch shared helpers or the database schema. Runtime behavior only changes for the BenchmarkTest00996 endpoint: its CallableStatement now passes the cookie-derived value as the first argument to a fixed verifyUserPassword stored procedure instead of executing whatever call string the attacker supplied, which is the intended security-hardening outcome but will shift this case's classification in Benchmark scoring.

---

About Apiiro Autofix

This PR was automatically generated by Apiiro Autofix. Review all changes carefully before merging and run your test suite to verify no regressions.

[karencapiiro]

Checkmarx One – Scan Summary & Details – 28869ecb-9552-4d80-bad8-daf9f9099a38

---

New Issues (2510)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02059.java: 44	Attack Vector
2		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01929.java: 45	Attack Vector
3		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01601.java: 43	Attack Vector
4		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01430.java: 45	Attack Vector
5		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01674.java: 43	Attack Vector
6		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02244.java: 43	Attack Vector
7		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02243.java: 43	Attack Vector
8		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02333.java: 45	Attack Vector
9		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01441.java: 45	Attack Vector
10		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01446.java: 45	Attack Vector
11		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02250.java: 43	Attack Vector
12		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02343.java: 45	Attack Vector
13		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01938.java: 45	Attack Vector
14		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02249.java: 43	Attack Vector
15		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01673.java: 43	Attack Vector
16		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02611.java: 43	Attack Vector
17		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01193.java: 44	Attack Vector
18		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01943.java: 45	Attack Vector
19		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00304.java: 44	Attack Vector
20		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02067.java: 44	Attack Vector
21		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01936.java: 45	Attack Vector
22		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02151.java: 43	Attack Vector
23		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01189.java: 44	Attack Vector
24		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01286.java: 43	Attack Vector
25		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00159.java: 45	Attack Vector
26		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01609.java: 43	Attack Vector
27		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01064.java: 45	Attack Vector
28		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00568.java: 45	Attack Vector
29		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02340.java: 45	Attack Vector
30		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02334.java: 45	Attack Vector
31		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00294.java: 44	Attack Vector
32		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00303.java: 44	Attack Vector
33		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00293.java: 44	Attack Vector
34		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00824.java: 43	Attack Vector
35		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01687.java: 43	Attack Vector
36		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01685.java: 43	Attack Vector
37		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00732.java: 43	Attack Vector
38		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01362.java: 43	Attack Vector
39		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00295.java: 44	Attack Vector
40		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00575.java: 45	Attack Vector
41		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01940.java: 45	Attack Vector
42		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01850.java: 57	Attack Vector
43		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01851.java: 57	Attack Vector
44		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00968.java: 57	Attack Vector
45		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00970.java: 57	Attack Vector
46		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01353.java: 43	Attack Vector
47		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02251.java: 43	Attack Vector
48		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02252.java: 43	Attack Vector
49		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02253.java: 43	Attack Vector
50		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02069.java: 44	Attack Vector
51		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01194.java: 44	Attack Vector
52		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00481.java: 43	Attack Vector
53		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02152.java: 43	Attack Vector
54		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01285.java: 43	Attack Vector
55		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest02146.java: 43	Attack Vector
56		Command_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest01852.java: 57	Attack Vector

More results are available on the CxOne platform

---

Fixed Issues (2)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	SQL_Injection	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00996.java: 57
	SQL_Injection_Evasion_Attack	src/main/java/org/owasp/benchmark/testcode/BenchmarkTest00996.java: 57

---

Communicate with Checkmarx by submitting a PR comment with @Checkmarx followed by one of the supported commands. Learn about the supported commands here.