...
| Code Block | ||
|---|---|---|
| ||
private void storeDateinDB(java.util.Date date) throws SQLException {
final java.util.Date copy = new java.util.Date(date.getTime());
if (validateValue(copy.getTime())) {
Connection con = DriverManager.getConnection("jdbc:microsoft:sqlserver://<HOST>:1433","<UID>","<PWD>");
PreparedStatement pstmt = con.prepareStatement("UPDATE ACCESSDB SET TIME = ?");
pstmt.setLong(1, copy.getTime());
// ...
}
}
|
...
Applicability
Using the clone() method to copy untrusted arguments affords attackers the opportunity to bypass validation and security checks.
Guideline | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
MET52-JG | high | likely | low | P27 | L1 |
Automated Detection
Automated detection is not feasible.
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this guideline on the CERT website.
Bibliography
...