rulesets.GDS.CWE.cwe-0113-http-response-splitting.xml Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of pmd-gds Show documentation

Custom ruleset for the open source static analysis tool PMD. The ruleset contains rules intended to identify security violations that map to the 2013 OWASP Top 10

There is a newer version: 2.33.0

Show newest version

<?xml version="1.0" encoding="UTF-8"?>
<ruleset name="A10 - Unvalidated Redirects and Forwards"
		 xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd">

	<description>
   		This file is part of the GDS PMD Secure Coding Ruleset.
   		
   		This ruleset contains rules that are intended to detect HTTP Response Splitting.
   </description>

	<rule class="com.gdssecurity.pmd.rules.dfa.DfaSecurityRule" name="HTTPResponseSplitting"
		message="HTTP Response Splitting" dfa="true" typeResolution="true" language="java"
		externalInfoUrl="https://cwe.mitre.org/data/definitions/113.html">
		<description>
	This rule utilizes the PMD data flow analysis (DFA) layer to help trace input from source to sink. 
	PMD is unable to track data flow from source to sink across files.
	Therefore, the scope of analysis is limited to a single file and even within that a single method (i.e. PMD DFA is intraprocedural).

      </description>

		<priority>1</priority>

		<properties>
			<property name="sinks">
				<value>
				|javax.servlet.http.HttpServletResponse.addDateHeader
				|javax.servlet.http.HttpServletResponse.addHeader
				|javax.servlet.http.HttpServletResponse.addIntHeader
				|javax.servlet.http.HttpServletResponse.sendError
				|javax.servlet.http.HttpServletResponse.sendRedirect
				|javax.servlet.http.HttpServletResponse.setDateHeader
				|javax.servlet.http.HttpServletResponse.setHeader
				|javax.servlet.http.HttpServletResponse.setIntHeader
				|javax.servlet.http.HttpServletResponse.setStatus				
				</value>
			</property>
		</properties>

	</rule>

</ruleset>