Sorcerer's Tower

Entries tagged "qpscanner"

QueryParam Scanner (qpscanner) is a tool I created for scanning CFML code and finding potential risks of SQL injection.

For more information see the blog articles below, or visit the project homepage.

Found 6 entries tagged with "qpscanner", displaying most recent 5 entries.

View entries: 1..5 6

QueryParam Scanner 0.8 Release Candidate

The release candidate for the next version of QueryParam Scanner is available on GitHub.

So what's changed?

Well it now runs on FW/1 rather than Fusebox, and the UI has a new theme - the previous gold/beige is gone, and in its place is a theme based on a "new" logo which I've actually had sitting around for several years. There's CSS used that will require a modern browser - FF4 and IE9 both work, but no guarantees for anything older.

Functionality-wise there's a couple of fixes: an error is now thrown when a directory doesn't exist (previous behaviour was to return 0 matches in 0 files), and the IDs returned in data structures are now content-based hashes (previously they were ever-changing UUIDs). Oh, and the IDs are now displayed with the HTML results, in preparation for future functionality that'll potentially use them.

A new experimental (i.e. buggy) feature has been added to seperate the query code into SELECT/FROM/WHERE/etc parts, when returning data structures. This may help with post-processing the data, but has known flaws so use with care. (The existing ORDER BY functionality has also been marked as experimental to similarly indicate that it's not perfect.)

There's a minor change in that relative paths are officially not supported - the UI always stated absolute paths or mappings were required, but there was ugly code in place to try and make relative paths work too - that code has been removed. If you used relative paths before, you need to resolve them before passing to qpscanner.

In summary:

Changed:  Switched to FW/1 and removed unnecessary files.
Changed:  New logo and front-end UI.
Removed:  Dropped unofficial relative path support.
Added:    Experimental ability to separate query code into segments
Fixed:    IDs now use content-based SHA hashes, not random UUIDs.
Fixed:    Throw error when path does not exist, instead of zero results.
Supports: ColdFusion 9/10 and Railo 3.3/4.0/4.1

That's it for now. There are several new features planned to make qpscanner faster, more flexible and more useful, but you'll have to wait for a future release for those.

As ever, if you have any feedback, feature requests, or find any bugs, then please go ahead and get in touch via the GitHub issue tracker.

QueryParam Scanner v0.7.5 Released

Earlier this week I promoted the release candidate for 0.7.5 of QueryParam Scanner to full release.

For anyone unaware, QueryParam Scanner is a simple tool for identifying unparameterised variables in CFML queries (which may indicate a potential SQL injection risk).

This version has a handful of bug fixes and code cleanups, resulting in faster more accurate scanning than previous versions, plus the addition of JSON output format, giving a more lightweight option if used in scripted processes.

For further details on these, see the previous RC article; other than a couple of trivial fixes and a new readme, nothing has changed since that.

To download the latest version, you can either clone the git repo, or grab it as a zip archive from the GitHub tags page.

For any feedback, problems, or questions, please use the issue tracker.

QueryParam Scanner 0.7.5 Release Candidate

I have just pushed an update of QueryParam Scanner to GitHub, containing various improvements.

This update is on the rc0.7.5 branch, and it'd be nice if people could take it for a spin and make sure there are no issues with it. (There is a zip download for anyone without git.)

The visible changes which you might notice are:

However, there are also significant under-the-hood changes. I removed my obsolete "Java Regex Utils" library (replacing it with the object part of cfRegex), and made a number of little code clean-ups.

A result of these changes is that qpscanner rc0.7.5 appears to be almost twice as fast as previous versions.

If you have any feedback, please feel free to contact me via GitHub, and similarly if you find any bugs then please raise them on the issue tracker.

QueryParam Scanner - Eclipse Plugin

The first pre-release version of the qpScanner Eclipse Plugin is now available.

This is the very first Eclipse plugin I have created. It was an interesting experience, and something that I will be writing up in a separate entry as soon as I can collect my thoughts.

It order to use the plugin, you must be using v0.7 or higher of qpScanner - if you do not yet have this, you can download the latest development version of qpScanner, which contains details of the Update Site to use. If for any reason you cannot use the regular Eclipse Update method, you can directly download the qpScanner Eclipse Plugin instead.

Just to be clear, both v0.7 of QueryParam Scanner and v0.1 of the qpScanner Eclipse Plugin are currently considered development releases, and are being made available so that they can be tested and any bugs that might exist can be found - if you are unwilling to use pre-release software you should wait until the official release.

If you do get the Eclipse Plugin, or even just qpScanner on its own, I welcome any and all feedback you might have - whether to report bugs you have found, request new features you would like, or simply to let me know that works with your local setup.

Please send feedback via the GitHub Issue system.

Related websites:

QueryParam Scanner v0.7-dev

The latest development version of qpScanner is now in SVN at RIAForge.

It would be great if people could test it out and let me know of any issues they encounter.

As before, it is all self-contained, so it can be installed and run with minimal effort.

Note: As this is still the development version, you need to use the zip option at the bottom of the RIAForge page, not the "Download Project" link - the button will only give the old version.

When released, v0.7 will be a significant new version, so I want to give a quick discussion of the new features...