Security - SQL validation
The SQL validation tab contains the following settings:
Field | Description |
|---|
Self-Service SQL validation | Set to Yes to enable validation of advanced SQL statements used in Self-Service Publisher Charts, Publisher Lists, and the REM and SUS dashboards.. The default value is No. |
DAM SQL validation | Set to Yes to enable validation of the SQL statements used in Data Aggregation Manager (DAM). The default value is No. When set to No, a basic level of protection is still active that blocks DELETE, UPDATE, and DROP statements. When set to Yes, the full validation is applied. |
What is validated?
The SQL validation checks for the following:
1. Syntax — The SQL statement must have valid syntax.
2. Allowed statement types — Only SELECT statements are allowed. Statements such as INSERT, UPDATE, DELETE, DROP, ALTER, and EXEC are rejected.
3. Restricted tables and columns — SQL statements must not reference blacklisted tables or columns that contain sensitive system and security data (for example, password, account access key, and system settings tables).
What happens when a validation error is found?
If the validation detects an issue, an error message is displayed indicating the nature and location of the problem, and the SQL validation setting is set back to No. The error message includes the location of the error.