Hello, in this lesson,
we're going to be talking about mitigating
SQL injection vulnerabilities using whitelisting.
By the end of this lesson,
you'll be able to define the term whitelisting,
and I'll walk you through a small example.
You'll also be able to discuss
the pros and cons of whitelisting.
So first, what is whitelisting?
Whitelisting is basically validating
that user control data follows a known specification,
or is within a set of data that is acceptable.
To give you an example,
if you have user controlled
data that specifies a table name,
and that table name is used in
a SQL query in the web app,
then you would want to check that
user control data against a set of valid table names.
Here we have that sort of a check.
This example comes from OWASP.
Here, it goes through the acceptable set of
table names that can be used in a particular SQL query.
Another example of whitelisting is,
if a user can choose the ascending versus
descending order of the returned results of a SQL query.
Sometimes, web app developers use the keywords
ASE and DESC in the SQL query.
These two keywords are used as user controlled input.
However, it's wise to
convert the ascending or descending values.
Those two keywords to the Boolean representation where
ASE means true and DESC means false,
and use that Boolean value as
a user controlled input to the SQL query.
So a pro for using whitelisting is that,
it can be simple to implement.
For example, with the previous example that we saw,
it was fairly simple to implement because
the whitelist is a small subset of valid input.
It was constrained to a set of
table names that were valid.
However, if the whitelist data
is a little bit more complex,
you might need to create a regular expression
to match valid input.
But that's okay because,
there are a lot of resources
online to help you write regular expressions.
To summarize, we went over what
whitelisting is and gave a couple of examples on that,
and then talked about the pros and cons of using
whitelisting to mitigate SQL injection vulnerabilities.
In fact, it's actually a good practice
to wherever you can perform
whitelisting or input validation in general to
basically mitigate a lot of
the other injection vulnerabilities.
It's good coding practice because,
it constrains what is
acceptable data to the input into the system.
As well, it helps
future developers of your codebase to know what data,
or what form the input data should be in.
That's it for now. Thank you for listening.