Add sanitization to fix SPARQL injection vulnerability.

vivo-project · Jan 28, 2019 · 248ef19 · 248ef19
1 parent 6e71744
commit 248ef19
Showing 1 changed file with 6 additions and 0 deletions.
diff --git a/api/src/main/java/edu/cornell/mannlib/vitro/webapp/dao/jena/IndividualSDB.java b/api/src/main/java/edu/cornell/mannlib/vitro/webapp/dao/jena/IndividualSDB.java
@@ -118,6 +118,12 @@ public IndividualSDB(String individualURI,
     	this.dwf = datasetWrapperFactory;
 		this.webappDaoFactory = wadf;
 
+		// Check that individualURI is valid. (Prevent SPARQL injection attack.)
+		// Valid syntax is defined here: https://www.w3.org/TR/rdf-sparql-query/#rIRI_REF
+		if (!individualURI.matches("[^<>\"{}|^`\\\\\u0000-\u0020]*")) {
+			throw new IndividualNotFoundException();
+		}
+
     	if (skipInitialization) {
             OntModel ontModel = ModelFactory.createOntologyModel(
                     OntModelSpec.OWL_MEM);