I am currently deving a java application using spring data JPA, postGIS, Hibernate, and geoTools. I have a controller GET method that takes in a query string as a parameter to be used to determine if Point objects in my data base are within the specified area passed in with the GET call. My happy path goes as follows: Get request is made -> query string is a GeoJson -> controller sends that string to a service level -> service level calls repository -> repository uses Spring data JPA to perform this query:

WHERE st_within(shop.point_geom, 
                st_setsrid(st_geomfromgeojson(:input), 4326)) = TRUE

now this works fine and dandy, and I am now in the testing phase. What I am trying to test currently is whether or not this query is safe from SQL injection. The only info I can find on the web when researching geomFromGeoJson and sql injection is over a node.js ORM library. So would anyone with java and postGIS experience be willing to send me in the right direction?


It depends on what your library is actually doing with that query. If it's taking your GeoJSON input and slamming it all into a SQL string, then yes, it's an injection vector, but then so would any other kind of input. More likely, a mature framework will be preparing that query and running it using the :input as a parameter when executing prepared query, which will be perfectly safe from injection. You can confirm which case is happening by turning on statement logging in your backend and watching what queries your app actually constructs and sends.

  • Thanks for your input. I ended up de-serializing the GeoJson first to only extract a polygon portion of the GeoJson to a polygon object which I then pass as a parameter to the query. I'm using spring data jpa but that all sits on top of hibernate which is actually querying postGreSql. So far in testing this has worked fine. And yes that logging did help! – Adam De Leon Nov 21 '17 at 14:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.