Spring data JPA Checkmarx vulnerability- Improper Resource Access Authorization for @Query annotation

Question

We are currently working on web application with persistence layer implemented using Spring data JPA and its working out really well for us however while scanning our code using checkmarx it complains for "Improper Resource Access Authorization" error for all input parameter in below code snippet.Not sure how to resolve it.Based of my understanding we tried following approach but that didn't help either

• Whitelist input parameter using using @valid and @Pattern annotations

• Secure method using @Secured("ROLE_TEST") annotation of spring security.

  @Repository
  public interface EmployeeAddressRepository extends JpaRepository<EmployeeAddress, Integer> {
  
    @Query("select empAdd from EmployeeAddress empAdd where empAdd.Employee.employeeId=?1 and (endDate) ORDER BY empAdd.lastUpdateTimeStamp DESC")
    List<EmployeeAddress> findEmployeeAddressByEmployeeId(String employeeId, LocalDate date) throws PersistenceException;
  }
  

Looking forward for any pointer here to move forward in right direction

Answer 1

Perhaps Checkmarx doesn't support ordinal parameters notation, try rewriting the query like so:

@Query("select empAdd from EmployeeAddress empAdd where empAdd.Employee.employeeId= :empId and (endDate) ORDER BY empAdd.lastUpdateTimeStamp DESC", employeeIdParameter)

where employeeIdParameter is the input parameter.

Hope this helps, Amit