SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 196

changes.mady.by.user Will Snavely

Saved on

compared with

New Version 197

changes.mady.by.user Alexandre GIGLEUX

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Failure to sanitize user input before processing or storing it can result in injection attacks.

Rule

Severity

Likelihood

Remediation Cost

Priority

Level

IDS00-J

High

Probable

Medium

P12

L1

Automated Detection

ToolVersionCheckerDescription
The Checker Framework

Include Page
The Checker Framework_V
The Checker Framework_V

Tainting CheckerTrust and security errors (see Chapter 8)
CodeSonar
Include Page
CodeSonar_V
CodeSonar_V
FB.SECURITY.SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING
FB.SECURITY.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE		A prepared statement is generated from a nonconstant String
Nonconstant string passed to execute method on an SQL statement
Coverity7.5

SQLI
FB.SQL_PREPARED_STATEMENT_GENERATED_
FB.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE

Implemented
Findbugs1.0SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTEImplemented
Fortify1.0

HTTP_Response_Splitting
SQL_Injection__Persistence
SQL_Injection

Implemented
Klocwork
 

SV.DATA.BOUND
SV.DATA.DB
SV.HTTP_SPLIT
SV.PATH
SV.PATH.INJ
SV.SQL

Implemented
Parasoft Jtest
Include Page
java:
Parasoft_V
java:
Parasoft_V
BD-SECURITY-TDSQLImplemented
SonarQube Java Plugin
Include Page
SonarQube Java Plugin_V
SonarQube Java Plugin_V

S2077

S3649

Implemented

Related Vulnerabilities

CVE-2008-2370 describes a vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. When a RequestDispatcher is used, Tomcat performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

Related Guidelines

SEI CERT C Coding Standard

STR02-C. Sanitize data passed to complex subsystems

SEI CERT C++ Coding Standard

VOID STR02-CPP. Sanitize data passed to complex subsystems

SEI CERT Perl Coding StandardIDS33-PL. Sanitize untrusted data passed across a trust boundary

ISO/IEC TR 24772:2013

Injection [RST]

MITRE CWE

CWE-116, Improper Encoding or Escaping of Output

Android Implementation Details

This rule uses Microsoft SQL Server as an example to show a database connection. However, on Android, DatabaseHelper from SQLite is used for a database connection. Because Android apps may receive untrusted data via network connections, the rule is applicable.

Bibliography

[OWASP 2005]

A Guide to Building Secure Web Applications and Web Services

[OWASP 2007]

OWASP Top 10 for Java EE

[Seacord 2015]
Image result for video iconImage Modified IDS00-J. Prevent SQL Injection LiveLesson

[W3C 2008]

Section 4.4.3, "Included If Validating"

...


...