All Downloads are FREE. Search and download functionalities are using the official Maven repository.
  • Log In
  • Register

    • org.sonar.plugins.findbugs.rules-jsp.xml Maven / Gradle / Ivy

    Go to download

    SpotBugs is a program that uses static analysis to look for bugs in Java code. It can detect a variety of common coding mistakes, including thread synchronization problems, misuse of API methods.

    There is a newer version: 4.3.0
    Show newest version
    <rules><!-- This file is auto-generated. -->
  <rule key='JSP_INCLUDE' priority='CRITICAL'>
    <name>Security - Dynamic JSP inclusion</name>
    <configKey>JSP_INCLUDE</configKey>
    <description>&lt;p&gt;The inclusion of JSP file allow the entry of dynamic value. It may allow an attacker to control the JSP page included.
If this is the case, an attacker will try to include a file on disk that he controls. By including arbitrary files, the
attacker gets the ability to execute any code.
&lt;/p&gt;
&lt;p&gt;
    &lt;b&gt;Vulnerable Code:&lt;/b&gt;
    &lt;pre&gt;&amp;lt;jsp:include page="${param.secret_param}" /&amp;gt;&lt;/pre&gt;
&lt;/p&gt;
&lt;p&gt;
    &lt;b&gt;Solution:&lt;/b&gt;
    &lt;pre&gt;&amp;lt;c:if test="${param.secret_param == 'page1'}"&amp;gt;
    &amp;lt;jsp:include page="page1.jsp" /&amp;gt;
&amp;lt;/c:if&amp;gt;&lt;/pre&gt;
&lt;/p&gt;
&lt;br/&gt;
&lt;p&gt;
&lt;b&gt;References&lt;/b&gt;&lt;br/&gt;
&lt;a href="https://resources.infosecinstitute.com/file-inclusion-attacks/"&gt;InfosecInstitute: File Inclusion Attacks&lt;/a&gt;&lt;br/&gt;
&lt;a href="http://projects.webappsec.org/w/page/13246955/Remote%20File%20Inclusion"&gt;WASC-05: Remote File Inclusion&lt;/a&gt;&lt;br/&gt;
&lt;/p&gt;</description>
    <tag>wasc</tag>
    <tag>jsp</tag>
    <tag>security</tag>
  </rule>
  <rule key='JSP_SPRING_EVAL' priority='CRITICAL'>
    <name>Security - Dynamic variable in Spring expression</name>
    <configKey>JSP_SPRING_EVAL</configKey>
    <description>&lt;p&gt;A Spring expression is built with a dynamic value. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.
&lt;/p&gt;
&lt;p&gt;
    &lt;b&gt;Vulnerable Code:&lt;/b&gt;
    &lt;pre&gt;&amp;lt;%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %&amp;gt;

&amp;lt;spring:eval expression="${param.lang}" var="lang" /&amp;gt;&lt;/pre&gt;
    &lt;br&gt;
    &lt;pre&gt;&amp;lt;%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %&amp;gt;

&amp;lt;spring:eval expression="'${param.lang}'=='fr'" var="languageIsFrench" /&amp;gt;&lt;/pre&gt;
&lt;/p&gt;
&lt;p&gt;
    &lt;b&gt;Solution:&lt;/b&gt;
    &lt;pre&gt;&amp;lt;c:set var="lang" value="${param.lang}"/&amp;gt;&lt;/pre&gt;
    &lt;br/&gt;
    &lt;pre&gt;&amp;lt;c:set var="languageIsFrench" value="${param.lang == 'fr'}"/&amp;gt;&lt;/pre&gt;
&lt;/p&gt;
&lt;br/&gt;
&lt;p&gt;
&lt;b&gt;References&lt;/b&gt;&lt;br/&gt;
    &lt;a href="https://cwe.mitre.org/data/definitions/94.html"&gt;CWE-94: Improper Control of Generation of Code ('Code Injection')&lt;/a&gt;&lt;br/&gt;
    &lt;a href="https://cwe.mitre.org/data/definitions/95.html"&gt;CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')&lt;/a&gt;&lt;br/&gt;
&lt;/p&gt;</description>
    <tag>owasp-a1</tag>
    <tag>injection</tag>
    <tag>cwe</tag>
    <tag>jsp</tag>
    <tag>security</tag>
  </rule>
  <rule key='JSP_JSTL_OUT' priority='MAJOR'>
    <name>Security - Escaping of special XML characters is disabled</name>
    <configKey>JSP_JSTL_OUT</configKey>
    <description>&lt;p&gt;A potential XSS was found. It could be used to execute unwanted JavaScript in a client's browser. (See references)
&lt;/p&gt;
&lt;p&gt;
    &lt;b&gt;Vulnerable Code:&lt;/b&gt;
    &lt;pre&gt;&amp;lt;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %&amp;gt;

&amp;lt;c:out value="${param.test_param}" escapeXml="false"/&amp;gt;&lt;/pre&gt;
&lt;/p&gt;
&lt;p&gt;
    &lt;b&gt;Solution:&lt;/b&gt;
    &lt;pre&gt;&amp;lt;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %&amp;gt;

&amp;lt;c:out value="${param.test_param}"/&amp;gt;&lt;/pre&gt;
&lt;/p&gt;
&lt;br/&gt;
&lt;p&gt;
&lt;b&gt;References&lt;/b&gt;&lt;br/&gt;
&lt;a href="http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting"&gt;WASC-8: Cross Site Scripting&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet"&gt;OWASP: XSS Prevention Cheat Sheet&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_%28XSS%29"&gt;OWASP: Top 10 2013-A3: Cross-Site Scripting (XSS)&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://cwe.mitre.org/data/definitions/79.html"&gt;CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://docs.oracle.com/javaee/5/jstl/1.1/docs/tlddocs/c/out.html"&gt;JSTL Javadoc: Out tag&lt;/a&gt;&lt;br/&gt;
&lt;/p&gt;</description>
    <tag>owasp-a3</tag>
    <tag>wasc</tag>
    <tag>cwe</tag>
    <tag>jsp</tag>
    <tag>security</tag>
  </rule>
  <rule key='XSS_JSP_PRINT' priority='MAJOR'>
    <name>Security - Potential XSS in JSP</name>
    <configKey>XSS_JSP_PRINT</configKey>
    <description>&lt;p&gt;A potential XSS was found. It could be used to execute unwanted JavaScript in a client's browser. (See references)
&lt;/p&gt;
&lt;p&gt;
    &lt;b&gt;Vulnerable Code:&lt;/b&gt;
    &lt;pre&gt;&lt;%
String taintedInput = (String) request.getAttribute("input");
%&gt;
[...]
&amp;lt;%= taintedInput %&amp;gt;&lt;/pre&gt;
&lt;/p&gt;
&lt;p&gt;
    &lt;b&gt;Solution:&lt;/b&gt;
    &lt;pre&gt;
&amp;lt;%
String taintedInput = (String) request.getAttribute("input");
%&amp;gt;
[...]
&amp;lt;%= Encode.forHtml(taintedInput) %&amp;gt;
    &lt;/pre&gt;
&lt;/p&gt;
&lt;p&gt;
The best defense against XSS is context sensitive output encoding like the example above. There are typically 4 contexts to consider:
HTML, JavaScript, CSS (styles), and URLs. Please follow the XSS protection rules defined in the OWASP XSS Prevention Cheat Sheet,
which explains these defenses in significant detail.
&lt;/p&gt;
&lt;br/&gt;
&lt;p&gt;
&lt;b&gt;References&lt;/b&gt;&lt;br/&gt;
&lt;a href="http://projects.webappsec.org/w/page/13246920/Cross%20Site%20Scripting"&gt;WASC-8: Cross Site Scripting&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet"&gt;OWASP: XSS Prevention Cheat Sheet&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://www.owasp.org/index.php/Top_10_2013-A3-Cross-Site_Scripting_%28XSS%29"&gt;OWASP: Top 10 2013-A3: Cross-Site Scripting (XSS)&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://cwe.mitre.org/data/definitions/79.html"&gt;CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://code.google.com/p/owasp-java-encoder/"&gt;OWASP Java Encoder&lt;/a&gt;&lt;br/&gt;
&lt;/p&gt;</description>
    <tag>owasp-a3</tag>
    <tag>wasc</tag>
    <tag>cwe</tag>
    <tag>jsp</tag>
    <tag>security</tag>
  </rule>
  <rule key='JSP_XSLT' priority='CRITICAL'>
    <name>Security - A malicious XSLT could be provided to the JSP tag</name>
    <configKey>JSP_XSLT</configKey>
    <description>&lt;p&gt;
    "XSLT (Extensible Stylesheet Language Transformations) is a language for transforming XML documents into other XML documents".&lt;sup&gt;[1]&lt;/sup&gt;&lt;br/&gt;
    It is possible to attach malicious behavior to those style sheets. Therefore, if an attacker can control the content or the source of the
    style sheet, he might be able to trigger remote code execution.&lt;sup&gt;[2]&lt;/sup&gt;
&lt;/p&gt;
&lt;p&gt;
&lt;b&gt;Code at risk:&lt;/b&gt;&lt;br/&gt;
&lt;pre&gt;
&amp;#x3C;x:transform xml=&amp;#x22;${xmlData}&amp;#x22; xslt=&amp;#x22;${xsltControlledByUser}&amp;#x22; /&amp;#x3E;
&lt;/pre&gt;
&lt;/p&gt;
&lt;p&gt;
&lt;b&gt;Solution:&lt;/b&gt;&lt;br/&gt;
&lt;p&gt;
The solution would be to make sure the style sheet is loaded from a safe sources and make sure that vulnerabilities such as
Path traversal &lt;sup&gt;[3][4]&lt;/sup&gt; are not possible.
&lt;/p&gt;
&lt;p&gt;
&lt;b&gt;References&lt;/b&gt;&lt;br/&gt;
[1] &lt;a href="https://en.wikipedia.org/wiki/XSLT"&gt;Wikipedia: XSLT (Extensible Stylesheet Language Transformations)&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://prezi.com/y_fuybfudgnd/offensive-xslt/"&gt;Offensive XSLT&lt;/a&gt; by Nicolas Grégoire&lt;br/&gt;
[2] &lt;a href="https://www.agarri.fr/blog/archives/2012/07/02/from_xslt_code_execution_to_meterpreter_shells/index.html"&gt;From XSLT code execution to Meterpreter shells&lt;/a&gt; by Nicolas Grégoire&lt;br/&gt;
&lt;a href="https://xhe.myxwiki.org/xwiki/bin/view/Main/"&gt;XSLT Hacking Encyclopedia&lt;/a&gt; by Nicolas Grégoire&lt;br/&gt;
&lt;a href="https://www.acunetix.com/blog/articles/the-hidden-dangers-of-xsltprocessor-remote-xsl-injection/"&gt;Acunetix.com : The hidden dangers of XSLTProcessor - Remote XSL injection&lt;/a&gt;&lt;br/&gt;
&lt;a href="https://www.w3.org/TR/xslt"&gt;w3.org XSL Transformations (XSLT) Version 1.0&lt;/a&gt; : w3c specification&lt;br/&gt;
[3] &lt;a href="http://projects.webappsec.org/w/page/13246952/Path%20Traversal"&gt;WASC: Path Traversal&lt;/a&gt;&lt;br/&gt;
[4] &lt;a href="https://www.owasp.org/index.php/Path_Traversal"&gt;OWASP: Path Traversal&lt;/a&gt;&lt;br/&gt;
&lt;/p&gt;</description>
    <tag>owasp-a1</tag>
    <tag>injection</tag>
    <tag>owasp-a4</tag>
    <tag>wasc</tag>
    <tag>jsp</tag>
    <tag>security</tag>
  </rule>
  <rule key='XSS_REQUEST_PARAMETER_TO_JSP_WRITER' priority='MAJOR'>
    <name>Security - JSP reflected cross site scripting vulnerability</name>
    <configKey>XSS_REQUEST_PARAMETER_TO_JSP_WRITER</configKey>
    <description>&lt;p&gt;This code directly writes an HTTP parameter to JSP output, which allows for a cross site scripting
vulnerability. See &lt;a href="http://en.wikipedia.org/wiki/Cross-site_scripting"&gt;http://en.wikipedia.org/wiki/Cross-site_scripting&lt;/a&gt;
for more information.&lt;/p&gt;
&lt;p&gt;SpotBugs looks only for the most blatant, obvious cases of cross site scripting.
If SpotBugs found &lt;em&gt;any&lt;/em&gt;, you &lt;em&gt;almost certainly&lt;/em&gt; have more cross site scripting
vulnerabilities that SpotBugs doesn't report. If you are concerned about cross site scripting, you should seriously
consider using a commercial static analysis or pen-testing tool.
&lt;/p&gt;</description>
    <tag>owasp-a3</tag>
    <tag>jsp</tag>
    <tag>security</tag>
  </rule>
</rules>




    © 2015 - 2025 Weber Informatics LLC | Privacy Policy