com.h3xstream.findsecbugs.injection.trust.package-info Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of findsecbugs-plugin Show documentation

Core module of the project. It include all the FindBugs detectors. The resulting jar is the published plugin.

There is a newer version: 1.13.0

/**
 * 
 * Trust Boundary Violation is fancy name to describe tainted value passed directly to session attribute.
 * This could be an expected behavior that allow an attacker to change the session state.
 * 
 * 
 * When the parameter is dynamic, it is a lot more suspicious than when it is a dynamic value.
 * setAttribute( suspiciousValue, "true")
 * vs
 * setAttribute( "language" , commonDynamicValue)
 * 
 * 
 * For this reason, the trust boundary violation was split in two detectors.
 * This will allow user to hide the low priority of this detector.
 * 
 *
 * @see com.h3xstream.findsecbugs.injection.trust.TrustBoundaryViolationAttributeDetector
 * @see com.h3xstream.findsecbugs.injection.trust.TrustBoundaryViolationValueDetector
 */
package com.h3xstream.findsecbugs.injection.trust;