Code Review · Security
OWASP Top 10 for PowerBuilder: Coverage and Detection
PowerBuilder code is subject to several OWASP Top 10 risks: injection, cryptographic failures, hardcoded credentials, and insecure configuration. Visual Expert detects each of them directly in PowerScript and embedded SQL, and applies the same checks to Oracle and SQL Server code.
The tables below map every relevant OWASP Top 10 category to the rules that catch it, PowerBuilder first.
PowerBuilder
Broken Access Control
| Visual Expert rule | Severity |
|---|---|
| User input should not allow path injection or path traversal attacks | Critical |
Cryptographic Failures
| Visual Expert rule | Severity |
|---|---|
| Always use the AES encryption algorithm in a secure mode | Critical |
| Cryptographic hash functions should not use SHA-1 or Message-Digest algorithms | Critical |
| DES (Data Encryption Standard) or 3DES should not be used | Critical |
| Encryption algorithms must use an appropriate secure mode and padding scheme | Critical |
| Encryption keys should be long enough | Critical |
| Encryption keys should not be hardcoded | Critical |
Injection
| Visual Expert rule | Severity |
|---|---|
| Database queries should not be vulnerable to injection attacks | Critical |
| OS commands should not allow injection attacks | Critical |
Security Misconfiguration
| Visual Expert rule | Severity |
|---|---|
| IP addresses should not be hardcoded | Critical |
| Never use CoSetProxyBlanket or CoInitializeSecurity | Critical |
| Never use console logging in production | Minor |
Vulnerable and Outdated Components
| Visual Expert rule | Severity |
|---|---|
| The OLE web browser should not be used (no longer secure) | Critical |
Identification and Authentication Failures
| Visual Expert rule | Severity |
|---|---|
| User IDs and passwords should not be hardcoded | Critical |
Beyond the Top 10
A denial-of-service pattern OWASP documents outside the Top 10:2021 list.
| Visual Expert rule | Severity |
|---|---|
| Regular expressions should not allow denial-of-service attacks (ReDoS) | Critical |
Scan your own PowerBuilder code against these rules
Visual Expert checks PowerBuilder, Oracle and SQL Server code against the full inspection rule set, before issues reach production.
Try Visual Expert Free View all inspection rulesOracle
For a PowerBuilder application running against Oracle, Visual Expert scans the PL/SQL layer for the same OWASP categories.
| OWASP category | Visual Expert rule | Severity |
|---|---|---|
| A02 Cryptographic Failures | DES or 3DES used | Critical |
| A02 Cryptographic Failures | SHA-1 and Message-Digest hash algorithms should not be used in secure contexts | Critical |
| A03 Injection | Dynamically executing code is security-sensitive | Critical |
| A05 Security Misconfiguration | Sensitive SYS-owned functions should not be used | Critical |
SQL Server
| OWASP category | Visual Expert rule | Severity |
|---|---|---|
| A02 Cryptographic Failures | SHA-1 and Message-Digest hash algorithms should not be used in secure contexts | Critical |
| A03 Injection | Dynamically executing code is security-sensitive | Critical |
| A05 Security Misconfiguration | Hardcoded IP addresses are security-sensitive | Minor |
Beyond OWASP: code quality and reliability
Visual Expert also enforces rules that fall outside the OWASP Top 10 but reduce risk and technical debt in database code.
Oracle
| Visual Expert rule | Severity |
|---|---|
| DELETE and UPDATE statements should contain a WHERE clause | Critical |
| Nullable subqueries should not be used in NOT IN conditions | Critical |
| Exceptions should not be ignored | Critical |
| WHEN OTHERS clauses should be used for exception handling | Critical |
| WHEN OTHERS should not be the only exception handler | Critical |
| DBMS_OBFUSCATION_TOOLKIT package is removed | Major |
SQL Server
| Visual Expert rule | Severity |
|---|---|
| DELETE and UPDATE statements should contain a WHERE clause | Critical |
| Nullable subqueries should not be used in NOT IN conditions | Critical |
| SQL Server session configuration should be tracked | Major |
Frequently asked questions
Is Visual Expert OWASP compliant?
Visual Expert detects the OWASP Top 10 vulnerability categories that apply to PowerBuilder, Oracle and SQL Server code: injection, cryptographic failures, hardcoded credentials, and insecure configuration. It reports each one through its code inspection rules.
Which OWASP Top 10 categories apply to PowerBuilder?
For PowerBuilder code, Visual Expert covers A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A05 Security Misconfiguration, A06 Vulnerable and Outdated Components, and A07 Identification and Authentication Failures.
How can I check a PowerBuilder application for OWASP vulnerabilities?
Run a Visual Expert code inspection on your PowerBuilder, Oracle and SQL Server code. It scans PowerScript and embedded SQL against its rule set and flags the OWASP Top 10 patterns that apply, before they reach production.
In practice
For a security audit, a technical-debt review, or preparation for a compliance assessment (NIS2, DORA, or an internal security policy), this turns a generic checklist into concrete findings in your own codebase. Visual Expert runs these checks across the full PowerBuilder, Oracle, and SQL Server code, so issues surface before they reach production.