Skip to content

Conversation

@Revanza1106
Copy link

Memperbaiki SQL Injection vulnerability pada validator custom nik_exists dan password_exists di AppServiceProvider.php.

🐛 Masalah

Terdapat SQL Injection vulnerability karena penggunaan whereRaw() dengan string concatenation:

```php
->whereRaw("tanggal_lahir = '" . $parameters[0] . "'")
->whereRaw("nik = '" . $parameters[0] . "'")
```

✅ Perbaikan

Mengganti whereRaw() dengan where() yang menggunakan parameter binding:

```php
->where('tanggal_lahir', $parameters[0])
->where('nik', $parameters[0])
```

📝 Perubahan

  • Menghapus `whereRaw()` yang vulnerable
  • Menggunakan parameter binding via `where()`
  • Menyederhanakan kode dengan menghapus if-else yang tidak perlu

🔗 Terkait

Fixes #1403

Copy link
Contributor

@pandigresik pandigresik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OK, sudah lolos test juga php artisan test tests/Feature/SistemKomplainControllerTest.php

image

@vickyrolanda vickyrolanda changed the base branch from master to dev January 20, 2026 09:25
@vickyrolanda vickyrolanda merged commit b312baa into OpenSID:dev Jan 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Perbaikan SQL Injection di AppServiceProvider.php

3 participants