From c5530f521119f3efb8a5dacc4583f0f3e7037cf1 Mon Sep 17 00:00:00 2001 From: "github-agentic-autofix[bot]" <314318003+GitHub Agentic Autofix@users.noreply.github.com> Date: Tue, 29 Sep 2026 18:25:16 +0000 Subject: [PATCH 1/2] Initial plan From af52a73bca9519bd1afe2bea2eb21c7a43ba1e3b Mon Sep 17 00:00:00 2001 From: "github-agentic-autofix[bot]" <314318003+GitHub Agentic Autofix@users.noreply.github.com> Date: Tue, 29 Sep 2026 18:27:21 +0000 Subject: [PATCH 2/2] Parameterize order creation SQL Co-authored-by: felickz <1760475+felickz@users.noreply.github.com> --- WebGoat.NET/Data/OrderRepository.cs | 133 ++++++++++++++++------------ 1 file changed, 74 insertions(+), 59 deletions(-) diff --git a/WebGoat.NET/Data/OrderRepository.cs b/WebGoat.NET/Data/OrderRepository.cs index 084834ff..fcf5e7cd 100644 --- a/WebGoat.NET/Data/OrderRepository.cs +++ b/WebGoat.NET/Data/OrderRepository.cs @@ -3,8 +3,6 @@ using System; using System.Collections.Generic; using System.Linq; -using System.Globalization; -using System.Threading; namespace WebGoatCore.Data { @@ -25,66 +23,83 @@ public Order GetOrderById(int orderId) } public int CreateOrder(Order order) - { - Thread.CurrentThread.CurrentCulture = new CultureInfo("en-US"); - // These commented lines cause EF Core to do wierd things. - // Instead, make the query manually. - - // order = _context.Orders.Add(order).Entity; - // _context.SaveChanges(); - // return order.OrderId; - - string shippedDate = order.ShippedDate.HasValue ? "'" + string.Format("yyyy-MM-dd", order.ShippedDate.Value) + "'" : "NULL"; - var sql = "INSERT INTO Orders (" + - "CustomerId, EmployeeId, OrderDate, RequiredDate, ShippedDate, ShipVia, Freight, ShipName, ShipAddress, " + - "ShipCity, ShipRegion, ShipPostalCode, ShipCountry" + - ") VALUES (" + - $"'{order.CustomerId}','{order.EmployeeId}','{order.OrderDate:yyyy-MM-dd}','{order.RequiredDate:yyyy-MM-dd}'," + - $"{shippedDate},'{order.ShipVia}','{order.Freight}','{order.ShipName}','{order.ShipAddress}'," + - $"'{order.ShipCity}','{order.ShipRegion}','{order.ShipPostalCode}','{order.ShipCountry}')"; - sql += ";\nSELECT OrderID FROM Orders ORDER BY OrderID DESC LIMIT 1;"; - - using (var command = _context.Database.GetDbConnection().CreateCommand()) - { - command.CommandText = sql; - _context.Database.OpenConnection(); - - using var dataReader = command.ExecuteReader(); - dataReader.Read(); - order.OrderId = Convert.ToInt32(dataReader[0]); - } - - sql = ";\nINSERT INTO OrderDetails (" + - "OrderId, ProductId, UnitPrice, Quantity, Discount" + - ") VALUES "; - foreach (var (orderDetails, i) in order.OrderDetails.WithIndex()) - { - orderDetails.OrderId = order.OrderId; - sql += (i > 0 ? "," : "") + - $"('{orderDetails.OrderId}','{orderDetails.ProductId}','{orderDetails.UnitPrice}','{orderDetails.Quantity}'," + - $"'{orderDetails.Discount}')"; - } - - if (order.Shipment != null) - { - var shipment = order.Shipment; - shipment.OrderId = order.OrderId; - sql += ";\nINSERT INTO Shipments (" + - "OrderId, ShipperId, ShipmentDate, TrackingNumber" + - ") VALUES (" + - $"'{shipment.OrderId}','{shipment.ShipperId}','{shipment.ShipmentDate:yyyy-MM-dd}','{shipment.TrackingNumber}')"; - } - - using (var command = _context.Database.GetDbConnection().CreateCommand()) - { - command.CommandText = sql; - _context.Database.OpenConnection(); - command.ExecuteNonQuery(); - } - + { + using (var command = _context.Database.GetDbConnection().CreateCommand()) + { + command.CommandText = @"INSERT INTO Orders ( + CustomerId, EmployeeId, OrderDate, RequiredDate, ShippedDate, ShipVia, Freight, ShipName, ShipAddress, + ShipCity, ShipRegion, ShipPostalCode, ShipCountry + ) VALUES ( + @CustomerId, @EmployeeId, @OrderDate, @RequiredDate, @ShippedDate, @ShipVia, @Freight, @ShipName, + @ShipAddress, @ShipCity, @ShipRegion, @ShipPostalCode, @ShipCountry + ); + SELECT OrderID FROM Orders ORDER BY OrderID DESC LIMIT 1;"; + AddParameter(command, "@CustomerId", order.CustomerId); + AddParameter(command, "@EmployeeId", order.EmployeeId); + AddParameter(command, "@OrderDate", order.OrderDate); + AddParameter(command, "@RequiredDate", order.RequiredDate); + AddParameter(command, "@ShippedDate", order.ShippedDate); + AddParameter(command, "@ShipVia", order.ShipVia); + AddParameter(command, "@Freight", order.Freight); + AddParameter(command, "@ShipName", order.ShipName); + AddParameter(command, "@ShipAddress", order.ShipAddress); + AddParameter(command, "@ShipCity", order.ShipCity); + AddParameter(command, "@ShipRegion", order.ShipRegion); + AddParameter(command, "@ShipPostalCode", order.ShipPostalCode); + AddParameter(command, "@ShipCountry", order.ShipCountry); + _context.Database.OpenConnection(); + + using var dataReader = command.ExecuteReader(); + dataReader.Read(); + order.OrderId = Convert.ToInt32(dataReader[0]); + } + + using (var command = _context.Database.GetDbConnection().CreateCommand()) + { + var values = new List(); + foreach (var (orderDetails, i) in order.OrderDetails.WithIndex()) + { + orderDetails.OrderId = order.OrderId; + values.Add($"(@OrderId{i}, @ProductId{i}, @UnitPrice{i}, @Quantity{i}, @Discount{i})"); + AddParameter(command, $"@OrderId{i}", orderDetails.OrderId); + AddParameter(command, $"@ProductId{i}", orderDetails.ProductId); + AddParameter(command, $"@UnitPrice{i}", orderDetails.UnitPrice); + AddParameter(command, $"@Quantity{i}", orderDetails.Quantity); + AddParameter(command, $"@Discount{i}", orderDetails.Discount); + } + + command.CommandText = "INSERT INTO OrderDetails " + + "(OrderId, ProductId, UnitPrice, Quantity, Discount) VALUES " + + string.Join(",", values); + + if (order.Shipment != null) + { + var shipment = order.Shipment; + shipment.OrderId = order.OrderId; + command.CommandText += ";\nINSERT INTO Shipments " + + "(OrderId, ShipperId, ShipmentDate, TrackingNumber) VALUES " + + "(@ShipmentOrderId, @ShipperId, @ShipmentDate, @TrackingNumber)"; + AddParameter(command, "@ShipmentOrderId", shipment.OrderId); + AddParameter(command, "@ShipperId", shipment.ShipperId); + AddParameter(command, "@ShipmentDate", shipment.ShipmentDate); + AddParameter(command, "@TrackingNumber", shipment.TrackingNumber); + } + + _context.Database.OpenConnection(); + command.ExecuteNonQuery(); + } + return order.OrderId; } + private static void AddParameter(System.Data.Common.DbCommand command, string name, object? value) + { + var parameter = command.CreateParameter(); + parameter.ParameterName = name; + parameter.Value = value ?? DBNull.Value; + command.Parameters.Add(parameter); + } + public void CreateOrderPayment(int orderId, decimal amountPaid, string creditCardNumber, DateTime expirationDate, string approvalCode) { var orderPayment = new OrderPayment()