[PPP-5150] running Jenkins Unit Tests#9548
[PPP-5150] running Jenkins Unit Tests#9548eddie-martinez wants to merge 1 commit intopentaho:masterfrom
Conversation
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewUnsafe XXE (XML External Entity) expansion, is a type of vulnerability Vulnerable exampleprotected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
DocumentBuilder db = dbf.newDocumentBuilder();
InputSource is = new InputSource();
// Load the xml string into an InputSource object.
is.setCharacterStream(new StringReader( request.getParameter("xml") ));
// Parse it
db.parse(is);
}RemediationSet the following features on + try {
+ dbf.setFeature("http://xml.org/sax/features/external-general-entities", false);
+ } catch (ParserConfigurationException e) { }
+ try {
+ dbf.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+ } catch (ParserConfigurationException e) { }
+ try {
+ dbf.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+ } catch (ParserConfigurationException e) { }
+ try {
+ dbf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd",
+ false);
+ } catch (ParserConfigurationException e) { }
+ dbf.setXIncludeAware(false);
+ dbf.setExpandEntityReferences(false);
DocumentBuilder db = dbf.newDocumentBuilder();Code FlowsVulnerable data flow analysis result
Vulnerable data flow analysis result
Vulnerable data flow analysis result
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionOverviewPath traversal, also known as directory traversal, is a type of Vulnerable examplepublic class path_traversaLvuln {
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String DOCS_FOLDER = "/srv/www/docs";
String docName = statement.executeQuery(query); // Reading from DB
Path docPath = Paths.get(DOCS_FOLDER, docName);
File docFile = docPath.toFile();
FileUtils.copyFile(docFile, response.getOutputStream());
}
}In this example, an attacker can, via a stored parameter, inject a back-path, Remediationpublic class path_traversal_safe {
protected void doGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String DOCS_FOLDER = "/srv/www/docs";
String docName = statement.executeQuery(query); // Reading from DB
Path docPath = Paths.get(DOCS_FOLDER, docName);
+ Path normDocPath = docPath.normalize();
+ // Make sure the canonical path resides in the desired dir
+ if (normDocPath.startsWith(DOCS_FOLDER)) {
File docFile = docPath.toFile();
FileUtils.copyFile(docFile, response.getOutputStream());
+ }
}
}By checking that the folder name still starts with the predefined prefix, we Code FlowsVulnerable data flow analysis result
private String filename; private SasReader sasReader; /**
*/ } @OverRide /**
/**
|
This comment has been minimized.
This comment has been minimized.
❌ Build failed in 4m 22sBuild command: mvn clean verify -B -e -Daudit -Djs.no.sandbox -pl dbdialog❗ No tests found!Errors:Filtered log (click to expand)
ℹ️ This is an automatic message |
2 participants
No description provided.