Fix SQL Injection (Legacy & Modern) in Micronaut

SQL Injection in Micronaut environments usually occurs when developers bypass the built-in Repository pattern to execute raw SQL via JdbcOperations or EntityManager using string concatenation. While Micronaut Data is 'secure by default', legacy patterns or complex dynamic queries often introduce high-risk sinks. To secure the application, you must enforce the use of parameterized queries and leverage Micronaut's compile-time query validation.

The Vulnerable Pattern

@Controller("/users")
public class UserController {
    @Inject JdbcOperations jdbcOperations;
@Get("/{name}")
public List<User> findByName(String name) {
    // HACKER THREAT: Classic string concatenation leads to OOB/Blind SQLi
    String sql = "SELECT * FROM users WHERE name = '" + name + "'";
    return jdbcOperations.prepareStatement(sql, stmt -> {
        ResultSet rs = stmt.executeQuery();
        return mapResults(rs);
    });
}
}

The Secure Implementation

The vulnerability is neutralized by moving away from manual string building to Micronaut Data's Repository abstraction. The secure implementation uses 'Query Methods' where the framework automatically generates PreparedStatement logic, ensuring user input is strictly treated as data. For complex queries where raw SQL is required, the @Query annotation utilizes named parameters (e.g., :name). This triggers Micronaut's AST (Abstract Syntax Tree) transformations to validate the query at compile-time and bind variables securely at runtime, preventing any manipulation of the SQL command structure.

@JdbcRepository(dialect = Dialect.POSTGRES)
public interface UserRepository extends CrudRepository {
// MODERN: Micronaut Data generates safe SQL at compile-time
List<User> findByName(String name);

// LEGACY FIX: Using @Query with named parameters for complex logic
@Query("SELECT * FROM users WHERE name = :name")
List<User> findByCustomName(String name);
}