From f2938f5f4389465eeee30a5e82f6c3c9f635ebe0 Mon Sep 17 00:00:00 2001
From: snow <snow@snows-MacBook-Pro-2.local>
Date: Mon, 10 Aug 2026 15:23:15 -0700
Subject: [PATCH] Fix error SQL injection level 3

Signed-off-by: snow <snow@snows-MacBook-Pro-2.local>
---
 .../ErrorBasedSQLInjectionVulnerability.java  | 14 ++++++----
 ...rorBasedSQLInjectionVulnerabilityTest.java | 28 +++++++++++++++----
 2 files changed, 32 insertions(+), 10 deletions(-)

diff --git a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerability.java b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerability.java
index 507adfde3..8315744b6 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerability.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerability.java
@@ -150,14 +150,16 @@ public ResponseEntity<String> doesCarInformationExistsLevel2(
             htmlTemplate = "LEVEL_1/SQLInjection_Level1")
     public ResponseEntity<String> doesCarInformationExistsLevel3(
             @RequestParam Map<String, String> queryParams) {
-        String id = queryParams.get(Constants.ID);
-        id = id.replaceAll("'", "");
+        final String id = queryParams.get(Constants.ID);
         BodyBuilder bodyBuilder = ResponseEntity.status(HttpStatus.OK);
         bodyBuilder.body(ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE);
         try {
             ResponseEntity<String> response =
                     applicationJdbcTemplate.query(
-                            "select * from cars where id='" + id + "'",
+                            (conn) -> conn.prepareStatement("select * from cars where id=?"),
+                            (prepareStatement) -> {
+                                prepareStatement.setString(1, id);
+                            },
                             (rs) -> {
                                 if (rs.next()) {
                                     CarInformation carInformation = new CarInformation();
@@ -173,7 +175,8 @@ public ResponseEntity<String> doesCarInformationExistsLevel3(
                                     } catch (JsonProcessingException e) {
                                         LOGGER.error("Following error occurred", e);
                                         return bodyBuilder.body(
-                                                GENERIC_EXCEPTION_RESPONSE_FUNCTION.apply(e));
+                                                ErrorBasedSQLInjectionVulnerability
+                                                        .CAR_IS_NOT_PRESENT_RESPONSE);
                                     }
                                 } else {
                                     return bodyBuilder.body(
@@ -185,7 +188,8 @@ public ResponseEntity<String> doesCarInformationExistsLevel3(
             return response;
         } catch (Exception ex) {
             LOGGER.error("Following error occurred", ex);
-            return bodyBuilder.body(GENERIC_EXCEPTION_RESPONSE_FUNCTION.apply(ex));
+            return bodyBuilder.body(
+                    ErrorBasedSQLInjectionVulnerability.CAR_IS_NOT_PRESENT_RESPONSE);
         }
     }
 
diff --git a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerabilityTest.java b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerabilityTest.java
index a665b7540..35aa55f95 100644
--- a/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerabilityTest.java
+++ b/src/test/java/org/sasanlabs/service/vulnerability/sqlInjection/ErrorBasedSQLInjectionVulnerabilityTest.java
@@ -5,6 +5,7 @@
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.eq;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 
 import java.io.IOException;
@@ -72,16 +73,33 @@ void doesCarInformationExistsLevel2_ExpectParamEscaped() throws IOException {
     }
 
     @Test
-    void doesCarInformationExistsLevel3_ExpectParamEscaped() throws IOException {
+    void doesCarInformationExistsLevel3_ExpectValidResponse() {
+        // Arrange
+        Map<String, String> queryParams = new HashMap<>();
+        queryParams.put(Constants.ID, "1");
+
+        ResponseEntity<String> mockResponseEntity =
+                ResponseEntity.status(HttpStatus.OK).body("Sample response");
+        doReturn(mockResponseEntity)
+                .when(template)
+                .query(
+                        Mockito.any(PreparedStatementCreator.class),
+                        Mockito.any(PreparedStatementSetter.class),
+                        Mockito.any(ResultSetExtractor.class));
+
         // Act
-        final Map<String, String> queryParams = Collections.singletonMap("id", "1'");
-        errorBasedSQLInjectionVulnerability.doesCarInformationExistsLevel3(queryParams);
+        ResponseEntity<String> response =
+                errorBasedSQLInjectionVulnerability.doesCarInformationExistsLevel3(queryParams);
 
         // Assert
+        assertEquals(HttpStatus.OK, response.getStatusCode());
+        assertEquals("Sample response", response.getBody());
         verify(template)
                 .query(
-                        eq("select * from cars where id='1'"),
-                        (ResultSetExtractor<? extends Object>) any());
+                        Mockito.any(PreparedStatementCreator.class),
+                        Mockito.any(PreparedStatementSetter.class),
+                        Mockito.any(ResultSetExtractor.class));
+        verify(template, never()).query(anyString(), (ResultSetExtractor<? extends Object>) any());
     }
 
     @Test