Uploaded image for project: 'JCommune'
  1. JCommune
  2. JC-1964

SQL injection leads to exception instead of error message

VotersWatchers
    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Closed (View Workflow)
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 2.10 Larks
    • Fix Version/s: 2.12 Larks
    • Labels:
      None
    • Sprint:
      2.12 Larks

      Description

      Precondition

      Steps to reproduce:

      1. Login and open Create Topic page
      2. Go to "Ending date" field.
      3. Convert the field to textarea using WebDeveloper plugin (Forms -> Convert Text Inputs to Textsreas)
      4. Type any sql-injection, for example: 1' OR '1'='1
      5. Press "Save" button

      Actual result: Following error message appears:

      Failed to convert property value of type java.lang.String to required type org.joda.time.DateTime for property topic.poll.endingDate; nested exception is java.lang.IllegalArgumentException: Invalid format: "1 OR 1=1" is malformed at " OR 1=1"   
      

      Expected result: user-friendly error message is shown, for ex.
      EN: "Please, choose the correct date"
      RU: "Пожалуйста, выберите корректную дату"

        Attachments

          Structure

            Activity

              People

              • Assignee:
                ppavlov Pavlov Pasha (Inactive)
                Reporter:
                Irina_ Irina
              • Votes:
                0 Vote for this issue
                Watchers:
                7 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 1h 40m
                  1h 40m

                    Structure Helper Panel