ascanrules: SQLi PostgreSQL rename scan rule (all timing based)

Signed-off-by: kingthorin <[email protected]>

Author: kingthorin

addOns/ascanrules/CHANGELOG.md

@@ -7,6 +7,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 ### Changed
 - Maintenance changes.
 - Depends on an updated version of the Common Library add-on.
+- The SQL Injection - PostgreSQL scan rule and alerts have been renamed to clarify that they're timing based (Issue 7341).
 
 ### Added
 - Rules (as applicable) have been tagged in relation to HIPAA and PCI DSS.

addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionPostgreScanRule.java renamed to addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionPostgreSqlTimingScanRule.java

@@ -42,11 +42,11 @@
 import org.zaproxy.zap.model.TechSet;
 
 /**
- * The SqlInjectionPostgreScanRule identifies Postgresql specific SQL Injection vulnerabilities
- * using Postgresql specific syntax. If it doesn't use Postgresql specific syntax, it belongs in the
- * generic SQLInjection class! Note the ordering of checks, for efficiency is : 1) Error based (N/A)
- * 2) Boolean Based (N/A - uses standard syntax) 3) UNION based (N/A - uses standard syntax) 4)
- * Stacked (N/A - uses standard syntax) 5) Blind/Time Based (Yes)
+ * The SqlInjectionPostgreSqlTimingScanRule identifies Postgresql specific SQL Injection
+ * vulnerabilities using Postgresql specific syntax. If it doesn't use Postgresql specific syntax,
+ * it belongs in the generic SQLInjection class! Note the ordering of checks, for efficiency is : 1)
+ * Error based (N/A) 2) Boolean Based (N/A - uses standard syntax) 3) UNION based (N/A - uses
+ * standard syntax) 4) Stacked (N/A - uses standard syntax) 5) Blind/Time Based (Yes)
  *
  * <p>See the following for some great specific tricks which could be integrated here
  * http://www.websec.ca/kb/sql_injection
@@ -60,7 +60,7 @@
  *
  * @author 70pointer
  */
-public class SqlInjectionPostgreScanRule extends AbstractAppParamPlugin
+public class SqlInjectionPostgreSqlTimingScanRule extends AbstractAppParamPlugin
         implements CommonActiveScanRuleInfo {
 
     private boolean doTimeBased = false;
@@ -198,7 +198,8 @@ public class SqlInjectionPostgreScanRule extends AbstractAppParamPlugin
                                 CommonAlertTag.OWASP_2017_A01_INJECTION,
                                 CommonAlertTag.WSTG_V42_INPV_05_SQLI,
                                 CommonAlertTag.HIPAA,
-                                CommonAlertTag.PCI_DSS));
+                                CommonAlertTag.PCI_DSS,
+                                CommonAlertTag.TEST_TIMING));
         alertTags.put(PolicyTag.DEV_FULL.getTag(), "");
         alertTags.put(PolicyTag.QA_STD.getTag(), "");
         alertTags.put(PolicyTag.QA_FULL.getTag(), "");
@@ -208,7 +209,8 @@ public class SqlInjectionPostgreScanRule extends AbstractAppParamPlugin
     }
 
     /** for logging. */
-    private static final Logger LOGGER = LogManager.getLogger(SqlInjectionPostgreScanRule.class);
+    private static final Logger LOGGER =
+            LogManager.getLogger(SqlInjectionPostgreSqlTimingScanRule.class);
 
     @Override
     public int getId() {

addOns/ascanrules/src/main/resources/org/zaproxy/zap/extension/ascanrules/resources/Messages.properties

@@ -186,7 +186,7 @@ ascanrules.sqlinjection.mssql.name = SQL Injection - MsSQL
 ascanrules.sqlinjection.mysql.name = SQL Injection - MySQL
 ascanrules.sqlinjection.name = SQL Injection
 ascanrules.sqlinjection.oracle.name = SQL Injection - Oracle
-ascanrules.sqlinjection.postgres.name = SQL Injection - PostgreSQL
+ascanrules.sqlinjection.postgres.name = SQL Injection - PostgreSQL (Time Based)
 ascanrules.sqlinjection.refs = https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html
 ascanrules.sqlinjection.soln = Do not trust client side input, even if there is client side validation in place.\nIn general, type check all data on the server side.\nIf the application uses JDBC, use PreparedStatement or CallableStatement, with parameters passed by '?'\nIf the application uses ASP, use ADO Command Objects with strong type checking and parameterized queries.\nIf database Stored Procedures can be used, use them.\nDo *not* concatenate strings into queries in the stored procedure, or use 'exec', 'exec immediate', or equivalent functionality!\nDo not create dynamic SQL queries using simple string concatenation.\nEscape all data received from the client.\nApply an 'allow list' of allowed characters, or a 'deny list' of disallowed characters in user input.\nApply the principle of least privilege by using the least privileged database user possible.\nIn particular, avoid using the 'sa' or 'db-owner' database users. This does not eliminate SQL injection, but minimizes its impact.\nGrant the minimum database access that is necessary for the application.
 ascanrules.sqlinjection.sqlite.alert.errorbased.extrainfo = The following known SQLite error message was provoked: [{0}].

addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionPostgreScanRuleUnitTest.java renamed to addOns/ascanrules/src/test/java/org/zaproxy/zap/extension/ascanrules/SqlInjectionPostgreSqlTimingScanRuleUnitTest.java

@@ -41,12 +41,13 @@
 import org.zaproxy.zap.model.TechSet;
 import org.zaproxy.zap.testutils.NanoServerHandler;
 
-/** Unit test for {@link SqlInjectionPostgreScanRule}. */
-class SqlInjectionPostgreScanRuleUnitTest extends ActiveScannerTest<SqlInjectionPostgreScanRule> {
+/** Unit test for {@link SqlInjectionPostgreSqlTimingScanRule}. */
+class SqlInjectionPostgreSqlTimingScanRuleUnitTest
+        extends ActiveScannerTest<SqlInjectionPostgreSqlTimingScanRule> {
 
     @Override
-    protected SqlInjectionPostgreScanRule createScanner() {
-        return new SqlInjectionPostgreScanRule();
+    protected SqlInjectionPostgreSqlTimingScanRule createScanner() {
+        return new SqlInjectionPostgreSqlTimingScanRule();
     }
 
     @Test
@@ -158,7 +159,7 @@ void shouldReturnExpectedMappings() {
         // Then
         assertThat(cwe, is(equalTo(89)));
         assertThat(wasc, is(equalTo(19)));
-        assertThat(tags.size(), is(equalTo(10)));
+        assertThat(tags.size(), is(equalTo(11)));
         assertThat(
                 tags.containsKey(CommonAlertTag.OWASP_2021_A03_INJECTION.getTag()),
                 is(equalTo(true)));
@@ -169,6 +170,7 @@ void shouldReturnExpectedMappings() {
                 tags.containsKey(CommonAlertTag.WSTG_V42_INPV_05_SQLI.getTag()), is(equalTo(true)));
         assertThat(tags.containsKey(CommonAlertTag.HIPAA.getTag()), is(equalTo(true)));
         assertThat(tags.containsKey(CommonAlertTag.PCI_DSS.getTag()), is(equalTo(true)));
+        assertThat(tags.containsKey(CommonAlertTag.TEST_TIMING.getTag()), is(equalTo(true)));
         assertThat(tags.containsKey(PolicyTag.DEV_FULL.getTag()), is(equalTo(true)));
         assertThat(tags.containsKey(PolicyTag.QA_STD.getTag()), is(equalTo(true)));
         assertThat(tags.containsKey(PolicyTag.QA_FULL.getTag()), is(equalTo(true)));