Time-Based Exchange Rates

These updates are applicable for releases - 2021.04, 2021.07, 2021.10, 2022.07, 2022.10, 2023.01, 2023.07, 2023.10, 2024.07.

Description

Time-based Structured Query Language (SQL) injection is a type of Blind injection attack. In a time-based attack, an attacker sends an SQL command to the server with code to force a delay in the execution of the queries.

Recommendation (Need to change)

• Implement proper Input validation controls to restrict special characters.
• Use parametrized queries including prepared statements.

Solution

In the snippets, red indicates removed or modified content, while green indicates added or replaced content.

Version: 2024.07, 2023.10, 2023.07, 2023.01, 2022.10, 2022.07, 2021.10

Change 1:

Path: localservices\ Fabric\ java\ DBPProductServices\ src\ main\ java\ com\ temenos\ dbx\ product\ forexservices\ resource\ api\ ForexResource.java

Package: com.temenos.dbx.product.forexservices.resource.api

• Import the package as shown below.
  

Respective Code: import com.kony.dbp.exception.ApplicationException;

• Add the throws ApplicationException at the end of the fetchDashboardCurrencyRates function.

Respective Code: throws ApplicationException

Change 2:

Path: localservices\ Fabric\ java\ DBPProductServices\ src\ main\ java\ com\ temenos\ dbx\ product\ forexservices\ resource\ impl\ ForexResourceImpl.java

Package: com.temenos.dbx.product.forexservices.resource.impl

• Import two packages as per below,

Respective Code:

import org.apache.commons.lang3.StringUtils;

import com.kony.dbp.exception.ApplicationException;

• Add throws ApplicationException at the end of the fetchDashboardCurrencyRates function.

Respective Code: throws ApplicationException

• Add the three conditional statements to the fetchDashboardCurrencyRates function. Include the conditions after the variables baseCurrencyCode, market & companyCode.

Respective Code:

if (StringUtils.isNotBlank(baseCurrencyCode) && !StringUtils.isAlphanumericSpace(baseCurrencyCode)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}

if (StringUtils.isNotBlank(market) && !StringUtils.isAlphanumericSpace(market)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}

if (StringUtils.isNotBlank(companyCode) && !StringUtils.isAlphanumericSpace(companyCode)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}

Change 3:

Path: localservices\ Fabric\ java\ forexservices\ src\ main\ java\ com\ temenos\ dbx\ product\ forexservices\ resource\ api\ ForexResource.java

Package: com.temenos.dbx.product.forexservices.resource.api

• Import the Package as show below.

Respective Code: import com.kony.dbp.exception.ApplicationException;

• Add the throws ApplicationException at the end of the fetchDashboardCurrencyRates function.

Respective Code: throws ApplicationException

Change 4:

Path: localservices\ Fabric\ java\ forexservices\ src\ main\ java\ com\ temenos\ dbx\ product\ forexservices\ resource\ impl\ ForexResourceImpl.java

Package: com.temenos.dbx.product.forexservices.resource.api

• Import two packages as per below.

Respective Code:

import org.apache.commons.lang3.StringUtils;

import com.kony.dbp.exception.ApplicationException;

• Add the throws ApplicationException at the end of the fetchDashboardCurrencyRates function.

Respective Code: throws ApplicationException

• Add three conditional statements to the fetchDashboardCurrencyRates function. Include the conditions after the variables baseCurrencyCode, market & companyCode.

Respective Code:

if (StringUtils.isNotBlank(baseCurrencyCode) && !StringUtils.isAlphanumericSpace(baseCurrencyCode)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}

if (StringUtils.isNotBlank(market) && !StringUtils.isAlphanumericSpace(market)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}

if (StringUtils.isNotBlank(companyCode) && !StringUtils.isAlphanumericSpace(companyCode)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}

Version: 2021.07, 2021.04

Change 1:

Path: localservices\ Fabric\ java\ DBPProductServices\ src\ main\ java\ com\ temenos\ dbx\ product\ forexservices\ resource\ api\ ForexResource.java

Package: com.temenos.dbx.product.forexservices.resource.api

• Import the package as shown below.

Respective Code: import com.kony.dbp.exception.ApplicationException;

• Add the throws ApplicationException at the end of the fetchDashboardCurrencyRates function.

Change 2:

Path: localservices\ Fabric\ java\ DBPProductServices\ src\ main\ java\ com\ temenos\ dbx\ product\ forexservices\ resource\ impl\ ForexResourceImpl.java

Package: com.temenos.dbx.product.forexservices.resource.api

• Import two packages as per below.

Respective Code:

import org.apache.commons.lang3.StringUtils;

import com.kony.dbp.exception.ApplicationException;

• Add throws ApplicationException at the end of the fetchDashboardCurrencyRates function.

Respective Code: throws ApplicationException

• Add the three conditional statements to the fetchDashboardCurrencyRates function. Include the conditions after the variables baseCurrencyCode, market & companyCode.

Respective Code:

if (StringUtils.isNotBlank(baseCurrencyCode) && !StringUtils.isAlphanumericSpace(baseCurrencyCode)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}
if (StringUtils.isNotBlank(market) && !StringUtils.isAlphanumericSpace(market)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}

if (StringUtils.isNotBlank(companyCode) && !StringUtils.isAlphanumericSpace(companyCode)) {
			// Security Fix to block special characters
			throw new ApplicationException(ErrorCodeEnum.ERR_10014);}