From 141d79ad31b00be0a4e9c5bc5331f47a369348e2 Mon Sep 17 00:00:00 2001
From: "cycode-security[bot]"
 <54410473+cycode-security[bot]@users.noreply.github.com>
Date: Sun, 26 Jul 2026 19:52:22 +0000
Subject: [PATCH] [Cycode] Fix for SAST detections - Unsanitized external input
 in SQL query

---
 .../lessons/sqlinjection/mitigation/Servers.java     | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/Servers.java b/src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/Servers.java
index f32c7d83691..b43f53c56de 100644
--- a/src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/Servers.java
+++ b/src/main/java/org/owasp/webgoat/lessons/sqlinjection/mitigation/Servers.java
@@ -1,3 +1,4 @@
+
 /*
  * SPDX-FileCopyrightText: Copyright © 2017 WebGoat authors
  * SPDX-License-Identifier: GPL-2.0-or-later
@@ -45,12 +46,17 @@ public Servers(LessonDataSource dataSource) {
   public List<Server> sort(@RequestParam String column) throws Exception {
     List<Server> servers = new ArrayList<>();
 
+    // Validate column parameter against whitelist
+    List<String> allowedColumns = List.of("id", "hostname", "ip", "mac", "status", "description");
+    if (!allowedColumns.contains(column)) {
+      throw new IllegalArgumentException("Invalid column name");
+    }
+
     try (var connection = dataSource.getConnection()) {
       try (var statement =
           connection.prepareStatement(
-              "select id, hostname, ip, mac, status, description from SERVERS where status <> 'out"
-                  + " of order' order by "
-                  + column)) {
+              "select id, hostname, ip, mac, status, description from SERVERS where status <> 'out of order' order by ?")) {
+        statement.setString(1, column);
         try (var rs = statement.executeQuery()) {
           while (rs.next()) {
             Server server =