SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 95

changes.mady.by.user Shannon Haas

Saved on

compared with

New Version 96

changes.mady.by.user Brendan Saulsbury

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

If validuser is actually a valid user name, this SELECT statement will select the validuser record in the table. The reason the hashed password is never checked is because username='validuser' is true; consequently the items after the OR are not tested. As long as the components after the OR generate a syntactically correct SQL expression, the attacker is granted the access of validuser.

To comply with rule MSC05-J. Store passwords using a hash function, the passwords must Passwords should be hashed. Unfortunately, many small systems fail to comply; consequently, the password text added in the query string would precisely match what the user enters. An attacker could supply a string for <PASSWORD> such as:

...

This noncompliant code example shows JDBC code to authenticate a user to a system. The password is passed as a char array, the database connection is created, and then the passwords are hashed to comply with MSC05-J. Store passwords using a hash function and MSC10-J. Limit the lifetime of sensitive data.

Unfortunately, this code example permits an SQL injection attack because the SQL statement sqlString accepts unsanitized input arguments. The attack scenario outlined above would work as described.

...

CERT C Secure Coding Standard

STR02-C. Sanitize data passed to complex subsystems

CERT C++ Secure Coding Standard

STR02-CPP. Sanitize data passed to complex subsystems

CVE-2008-2370

describes a vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. When a RequestDispatcher is used, Tomcat performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c16d1378a97f5d93-7a2d23be-4bc242c5-a24bb760-f8c254fc219f0fb9a1ff6e6c"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Injection [RST]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-116, "Improper Encoding or Escaping of Output"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6bd658f47e03fb5c-babd5b4a-4e8842cc-8cdd989e-5068873c47bcd20eacf7f641"><ac:plain-text-body><![CDATA[

[[OWASP 2005

AA. Bibliography#OWASP 05]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="c0e247ba10be5182-2f0509dc-40fc4233-a3259151-85f15c9ec0ad399f55b1d5cb"><ac:plain-text-body><![CDATA[

[[OWASP 2007

AA. Bibliography#OWASP 07]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="51a01f00d9ffb103-7e2f3ff4-48ca4124-b42ba6fd-ed36f21b20949af31b9875c0"><ac:plain-text-body><![CDATA[

[[OWASP 2008

AA. Bibliography#OWASP 08]]

 

]]></ac:plain-text-body></ac:structured-macro>

Testing for XML Injection (OWASP-DV-008)

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="e6920e21e627a8d3-05642616-4df64d1c-ac45a5db-50c9e66f051d39db64bb0dae"><ac:plain-text-body><![CDATA[

[[W3C 2008

AA. Bibliography#W3C 08]]

4.4.3 Included If Validating

]]></ac:plain-text-body></ac:structured-macro>

...