Aarogyasetu_android: Possibility of SQL Injection

[navrt007]

Hi Developer ,

Due to inline query there is a possible sql injection door open and many other places where inline queries are written.

private static final Migration MIGRATION_1_2 = new Migration(1, 2) {
    @Override
    public void migrate(SupportSQLiteDatabase database) {
        //"Migrating from database version 1 to database version 2");
        database.execSQL("BEGIN TRANSACTION");

        database.execSQL("CREATE TABLE nearby_devices_info_table_backup " +
                "(id INTEGER NOT NULL, bluetooth_mac_address TEXT,distance INTEGER, lat TEXT,long TEXT,timestamp INTEGER, PRIMARY KEY(timestamp))");

        database.execSQL("INSERT INTO nearby_devices_info_table_backup SELECT id,bluetooth_mac_address,distance,lat,long,timestamp FROM nearby_devices_info_table");
        database.execSQL("DROP TABLE nearby_devices_info_table");
        database.execSQL("ALTER TABLE nearby_devices_info_table_backup RENAME TO nearby_devices_info_table");
        database.execSQL("COMMIT");
        //"Migrated from database version 1 to database version 2 completed.");
    }
};

static final Migration MIGRATION_2_3 = new Migration(2,3) {
    @Override
    public void migrate(SupportSQLiteDatabase database) {
        //"Migrating from database version 2 to database version 3");
        database.execSQL("BEGIN TRANSACTION");
        database.execSQL("DROP TABLE user_device_info_table");
        database.execSQL("DROP TABLE user_location");
        database.execSQL("COMMIT");
        //"Migrated from database version 2 to database version 3 completed.");
    }
};

[cmdneo]

No, because it is not accepting any input and it is an app not a server and the database is stored as a single file(sqlite).

Edit: This is just a dummy repo, so it doesn't matter anyways.

[kamaravichow]

It's not a problem

[navrt007]

But is it good to expose your table name so easily and also in your select clause other places.
Don't think that's a industry standard

[cmdneo]

@navrt007 what do you mean by exposing table names?
And yeah IT IS AN APP you can just decompile the apk(it was not open sourced) to find strings related to SQL query or just look at the database file in your smartphone for such information, table/field names are nothing like passwords or anything secret. The database file is stored on your smartphone, it is not server code.

And there is nothing special about industry standard, they are just best practices.

What you are talking about is called security through obscurity which is a very bad practice, if a someone hacks a database server they won't have much problem knowing table and database names.

[navrt007]

I am no hacker ,i am just thinking as a developer hence the question why expose those table name so easily . If you think that is fine , each dev has different mindset.

[harishbhw94]

@axv42 Yes you are right..!