SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 21

changes.mady.by.user Michal Rozenau

Saved on

compared with

New Version Current

changes.mady.by.user David Svoboda

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: REM cost reform

...

Failure to sanitize user input before processing or storing it can result in injection attacks.

Rule

Severity

Likelihood

Detectable

RepairableRemediation Cost

Priority

Level

IDS16-J

High

Probable

Yes

NoMedium

P12

L1

Automated Detection

BDSECURITY
ToolVersionCheckerDescription
The Checker Framework

Include Page
The Checker Framework_V
The Checker Framework_V

Tainting CheckerTrust and security errors (see Chapter 8)
Fortify1.0

Missing_XML_Validation

Implemented
Klocwork

Include Page
Klocwork_V
Klocwork_V

JAVA.SV.XML.INVALIDImplemented
Parasoft Jtest
Include Page
Parasoft_V
Parasoft_V
CERT.IDS16.TDXMLProtect against XML data injection

Related Vulnerabilities

CVE-2008-2370 describes a vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. When a RequestDispatcher is used, Tomcat performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

...

[OWASP 2005]

A Guide to Building Secure Web Applications and Web Services

[OWASP 2007]

OWASP Top 10 for Java EE

[OWASP 2008]

Testing for XML Injection (OWASP-DV-008)

[Seacord 2015]
 Image result for video icon IDS00-J. Prevent SQL Injection LiveLesson

[W3C 2008]

Section 4.4.3, "Included If Validating"


...

IDS13-J. Use compatible character encodings on both sides of file or network IO Image Added