Rule Definition
The software constructs all or part of a data filter expression via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, the data filter expression command may be completely altered.

Remediation
Assume all input is malicious. Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent white-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack.

Violation Code Sample

// the argument inputFilter is given by an API request
private DataView FilverDataView(DataTable dv, string inputFilter)
{
    var dv = new DataView(dt);
    dv.RowFilter = "Col LIKE '%" + inputFilter + "%'"; // Possible injection
    return dv;
}

Fixed Code Sample

// the argument inputFilter is given by an API request
private DataView FilterDataView(DataTable dv, string inputFilter)
{
    var dv = new DataView(dt);
    dv.RowFilter = "Col LIKE '%" + SanitizeForRowFiler(inputFilter) + "%'";
    return dv;
}

private string SanitizeForRowFiler(string string inputFilter)
{
    // Note: take care of special characters, not just the quote:
    // ' " % & # \ / | ^ ~ = > < + - * ( ) [ ]
    return inputFilter.Replace("'", "");
}

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor https://cwe.mitre.org/data/definitions/200.html DataView.RowFilter Property https://docs.microsoft.com/en-us/dotnet/api/system.data.dataview.rowfilter