What Is SQL Injection and Why It Matters in OneStream?
This came up at a client the other day. They were performing a security audit on the OneStream Business Rules that had been written in their application. The audit was failing due to SQL Injection. So, what is SQL Injection and how do you write code to avoid it (and pass the Security Audit)?
SQL Injection is a security vulnerability that allows an attacker to modify SQL queries by injecting malicious code into the user input sections of a SQL query. Including concatenated User Input in the SQL Query allows SQL Injection.
The following code sample is from a OneStream Business Rule. It shows an example of a SQL Database query that is open to SQL Injection. The query is based on the user input of 2 variables, Sales Person First Name and Sales Person Last Name.
Dim dt as New DataTable
Dim strSalesPersonFirstName As String = "John"
Dim strSalesPersonLastName As String = "Doe"
Dim strCity As String = Nothing
using dbconn As DbConnInfo = BRApi.Database.CreateApplicationDbConnInfo(si)
Dim Sql As String = String.Empty
sql = $"SELECT City from XFC_TableView_SalesPerson WHERE SalesPersonFirstName = '{strSalesPersonFirstName}' AND SalesPersonLastName = '{strSalesPersonLastName}';"
dt = BRApi.Database.ExecuteSqlUsingReader(dbConn,sql.ToString,False)
If Not dt is Nothing Then
For Each RowNotInTableException As DataRow In dt.Rows
strCity = RowNotInTableException.Item("City")
Next
End If
brapi.ErroLog.LogMessage(si,"City=" & strCity.ToString)
End Using
The SQL Query is interpreted by VB.Net, which would replace the 2 string variables in the SQL query and pass that complete query to the database. It would look like “SELECT City from XFC_TableView_SalesPerson WHERE SalesPersonFirstName = ‘John’ AND SalesPersonLastName = ‘Doe’;” This opens the opportunity for an attacker to replace the 2 user inputted variables with other SQL Code that would get passed, concatenated into the query by VB.Net and run by the database.
So how to avoid this? One way is to separate the user input from the SQL Query using Parameterized Queries. Parameterized queries keep the User Input separate in the code from the SQL Query. Then the parameterized user input is passed separately from the SQL Query to the database.
In practice it goes as follows.
You will still use BRApi.Database.ExecuteSql or BRApi.Database.ExecuteSqlUsingReader. What you will do differently is use the version that takes a dbParamInfo object as a parameter.
Syntax
Public Function ExecuteSqlUsingReader(ByVal dbConn As DbConnInfo, ByVal sqlStatement As String, ByVal dbParaminfos As List(Of DbParaminfo),
ByVal useCommandTimeoutLarge As Boolean) As DataTable
dbParamInfo is a List(Of DbParamInfo). Basically, you load this list with the parameters and their values for your parameterized SQL query and pass this into your BRApi.Database.ExecuteSql or BRApi.Database.ExecuteSqlUsingReader.
1. In your Business Rule you create a DbParamInfo object and then add your variables and their values to it using “.Add”.
Dim dt as New DataTable
Dim strSalesPersonFirstName As String = "John"
Dim strSalesPersonLastName As String = "Doe"
Dim strCity As String = Nothing
Dim dbParamInfos As New List(Of DbParamInfo)
dbParamInfos.Add(New DbParamInfo("strSalesPersonFirstName", strSalesPersonFirstName))
dbParamInfos.Add(New DbParamInfo("strSalesPersonLastName", strSalesPersonLastName))
2. Then you parameterize your SQL query.
Using dbConn As DbConnInfo = BRApi.Database.CreateApplicationDBConnInfo(si)
Dim Sql As String = String.Empty
sql = $"SELECT City from XFC_TableView_SalesPerson WHERE SalesPersonFirstName = @strSalesPersonFirstName AND SalesPersonLastName = @strSalesPersonLastName;"
3. Finally, you pass both the SQL Query and the separate DbParamInfo object to your BRApi.Database.ExecuteSql or BRApi.Database.ExecuteSqlUsingReader call. Keeping the parameters separate from the SQL query. This way avoids SQL Injection.
The query in its entirety.
Dim dt as New DataTable
Dim strSalesPersonFirstName As String = "John"
Dim strSalesPersonLastName As String = "Doe"
Dim strCity As String = Nothing
Dim dbParamInfos As New List(Of DbParamInfo)
dbParamInfos.Add(New DbParamInfo("strSalesPersonFirstName", strSalesPersonFirstName))
dbParamInfos.Add(New DbParamInfo("strSalesPersonLastName", strSalesPersonLastName))
using dbconn As DbConnInfo = BRApi.Database.CreateApplicationDbConnInfo(si)
Dim Sql As String = String.Empty
sql = $"SELECT City from XFC_TableView_SalesPerson WHERE SalesPersonFirstName = @strSalesPersonFirstName AND SalesPersonLastName = @strSalesPersonLastName;"
dt = BRApi.Database.ExecuteSqlUsingReader(dbConn,sql.ToString,dbParamInfors,False)
If Not dt is Nothing Then
For Each RowNotInTableException As DataRow In dt.Rows
strCity = RowNotInTableException.Item("City")
Next
End If
brapi.ErroLog.LogMessage(si,"City=" & strCity.ToString)
End Using
It's not a large change to the way you are used to writing SQL queries in OneStream and it will help to avoid SQL injections (and pass security audits).
Partner SpotLight
OneStream aligns to your business needs and changes more quickly and easily than any other product by offering one platform and one model for all financial CPM solutions. OneStream XF employs Guided Workflows, validations and flexible mapping to deliver data quality confidence for all collections and analysis while reducing risk throughout the entire auditable financial process.
Our Company
MindStream Analytics' senior staff was there at the birth of Business Intelligence. We have been part of building Business Intelligence nationally from its humble niche product status to the ubiquitous analytic tool that it is today. MindStream consultants are well versed in reporting and information management and are ready to help you leverage the power of multiple tier-1vendors. From Oracle Hyperion to IBM Cognos, we can help you select and integrate the right tools for you to better understand your information. MindStream Analytics has experience across a wide variety of industries: Business Services, Consumer Products, Energy, Financial Services, Healthcare, Manufacturing, Transportation , and Telecommunication. We have the depth and breadth of experience to help you deliver actionable information to users.
Whether you need an enterprise wide Oracle BI Enterprise Edition (OBIEE) rollout, an Oracle BI Apps rollout, or an IBM Cognos ReportNet rollout, MindStream Analytics is here to help you succeed.
Case Studies
Accumen
Thanks to the intervention of MindStream Analytics, Accumen's Finance department can now model their business with a new, more organized structure that isn't conventionally available in NetSuite.
Acme Brick
Acme Brick turned to MindStream Analytics for help implementing OneStream to replace their outdated TM1 solution.
Alterra
Alterra sought the expertise of MindStream to address the challenges they faced in their Capital Planning process.
ATCO Group
Energy conglomerate ATCO operates worldwide in utilities, power generation, and related services.
Avalon
Working with MindStream Analytics, Avalon Healthcare Solutions adopts NetSuite Planning and Budgeting to accelerate budgeting and forecasting processes.
Bayer Health Care
Bayer Healthcare implemented Hyperion Planning and Workforce Planning in 10 weeks to dramatically streamline their Income Statement budget and Workforce Planning process..
BluEarth
MindStream Analytics' partnership with BluEarth Renewables epitomizes the power of technology and collaboration.
Celgene
An Oracle Hyperion Planning Upgrade provides multi-national organization Hyperion Application optimization and stabilization.
Cleaver Brooks
OneStream XF was chosen as the platform that would transform Cleaver-Brooks' Finance processes.
CoorsTek
The collaboration between CoorsTek and MindStream resulted in significant improvements in CoorsTek's financial consolidation and reporting processes.
Elite Body Sculpture
MindStream Analytics' collaboration with Elite Body Sculpture encapsulates the transformative potential of targeted tech solutions in streamlining administrative processes.
Enlyte
Enlyte, a merger of Mitchell, Genex, and Coventry, faced challenges with disparate financial solutions and the need for combined reporting.
Flanders
MindStream Analytics collaborated with Flanders to implement OneStream Consolidation and Reporting solution.
Foley Products
Foley Products was facing a significant challenge with its Excel-based actual management reporting system.
Harte Hanks
The collaboration between MindStream Analytics and Harte Hanks culminated in a highly customized, user-friendly NetSuite implementation.
Interface
Interface used a complex, manual, excel-based FP&A process for monthly review, and the summary data was loaded in OneStream.
Kymera International
Thanks to Mindstream Analytics' assistance, Kymera was able to load all of their data into OneStream and validate it successfully.
MacLean Fogg
MacLean-Fogg partnered with MindStream, a leading implementor specializing in modernizing and optimizing enterprise systems.
MEPPI
MindStream's expertise and experience were sought to conduct a vendor selection initiative focusing on MEPPI's F2023 planning process.
OUAI
MindStream Analytics and OUAI's collaboration showcases the transformative power of strategic technological intervention.
Plaskolite
By migrating to OneStream, Plaskolite has achieved a material reduction in consolidation time and overall Financial Close cycle, eliminated the hours spent compiling and verifying data in Excel, streamlined its Planning, Budgeting and Forecasting model and delivered flexible and timely reporting that enables more strategic analysis of their financial data.
Redwire
Understanding the nuances of Redwire's challenges, MindStream Analytics devised a holistic approach to overcome them. The implementation of NetSuite was just the beginning.
Simon
Simon's existing corporate Hyperion Financial Management (HFM) production application was consolidating at a rate of seven hours, a performance issue causing great headache to corporate Accounting.
Source Code
The successful transition to OneStream revolutionized Source Code's financial reporting.
Subway
Subway collaborated with MindStream Analytics for the NetSuite Analytics Warehouse implementation.
UPenn
MindStream Consulting and AppCare team members are proud be working side by side with UPenn university in accomplishing this implementation and along with continuing our AppCare services after go-live.
USG
USG was an Oracle Hyperion customer realizing that it needed more specialized support for its various Oracle Hyperion applications.
Vantiv
Dividing a hyperion planning application, expanding the hyperion footprint to forecast on the business? Customer categories.
Versant Health
Versant Health engaged MindStream to help resolve the challenges they were experiencing with their consolidation, close, and financial reporting processes.
Virginia Spaceport Authority
The MindStream team implemented the Standard + Workforce NetSuite Planning & Budgeting.
WeWork
MindStream Analytics determined that the best solution was to implement Oracle Essbase Cloud as part of the Oracle Analytics Cloud (OAC) platform-as-a-service
WindStream
Innovative use of essbase to streamline and connect hyperion financial management for enhanced financial analysis.
XY Planning
MindStream Analytics, well-versed in addressing such challenges, presented a comprehensive Netsuite solution for XY Planning.