Fix SQL Injection for UAT

[NormanWenzelWSS]

This PR contains an automated remediation suggestion created by Mend SAST. It will fix the following vulnerability in your custom code:

File	Vulnerability	CWE	Severity
SqlInjectionLesson9.java	SQL Injection	CWE-89	⚠️ High

[NormanWenzelWSS]

Mend Code Security Check

New finding (1 of 4)

The Mend Code Security Check of your branch failed because of a SQL Injection finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Date
High	SQL Injection	CWE-89	Servers.java:71	1	2023-07-04 09:25am
Vulnerable Code WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java Lines 66 to 71 in 34571d5 @ResponseBody public List<Server> sort(@RequestParam String column) throws Exception { List<Server> servers = new ArrayList<>(); try (Connection connection = dataSource.getConnection(); PreparedStatement preparedStatement = connection.prepareStatement("select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by " + column)) { 1 Data Flow/s detected View Data Flow 1 WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java Line 67 in 34571d5 public List<Server> sort(@RequestParam String column) throws Exception { WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java Line 71 in 34571d5 PreparedStatement preparedStatement = connection.prepareStatement("select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by " + column)) { WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java Line 71 in 34571d5 PreparedStatement preparedStatement = connection.prepareStatement("select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by " + column)) { Secure Code Warrior Training Material Training Secure Code Warrior SQL Injection Training Videos Secure Code Warrior SQL Injection Video Further Reading OWASP SQL Injection Prevention Cheat Sheet OWASP SQL Injection OWASP Query Parameterization Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk

[NormanWenzelWSS]

Mend Code Security Check

New finding (2 of 4)

The Mend Code Security Check of your branch failed because of a XSS finding in this line.

Severity	Vulnerability Type	CWE	File	Data Flows	Date
High	XSS	CWE-79	Servers.java:71	1	2023-07-04 09:25am
Vulnerable Code WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java Lines 66 to 71 in 34571d5 @ResponseBody public List<Server> sort(@RequestParam String column) throws Exception { List<Server> servers = new ArrayList<>(); try (Connection connection = dataSource.getConnection(); PreparedStatement preparedStatement = connection.prepareStatement("select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by " + column)) { 1 Data Flow/s detected View Data Flow 1 WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java Line 67 in 34571d5 public List<Server> sort(@RequestParam String column) throws Exception { WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java Line 71 in 34571d5 PreparedStatement preparedStatement = connection.prepareStatement("select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by " + column)) { WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/sql_injection/mitigation/Servers.java Line 71 in 34571d5 PreparedStatement preparedStatement = connection.prepareStatement("select id, hostname, ip, mac, status, description from servers where status <> 'out of order' order by " + column)) { Secure Code Warrior Training Material Training Secure Code Warrior SQL Injection Training Videos Secure Code Warrior SQL Injection Video Further Reading OWASP SQL Injection Prevention Cheat Sheet OWASP SQL Injection OWASP Query Parameterization Cheat Sheet Suppress Finding ... as False Alarm ... as Acceptable Risk