SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 101

changes.mady.by.user Masaki Kubo

Saved on

compared with

New Version 102

changes.mady.by.user Masaki Kubo

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This compliant solution defines a CustomResolver class that implements the interface org.xml.sax.EntityResolver. This enables a SAX application to implement customized handling of external entities. The setEntityResolver() method registers the implementation instance with the corresponding SAX driver. The customized handler uses a simple whitelist for external entities. The resolveEntity() method returns an empty InputSource when an input fails to resolve to any of the specified, safe entity source paths. Consequently, when parsing malicious input, the empty InputSource returned by the custom resolver causes a java.net.MalformedURLException to be thrown. Note that you must create an XMLReader object on which to set the custom entity resolver.

...

CERT C Secure Coding Standard

STR02-C. Sanitize data passed to complex subsystems

CERT C++ Secure Coding Standard

STR02-CPP. Sanitize data passed to complex subsystems

CVE-2008-2370

describes a vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. When a RequestDispatcher is used, Tomcat performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="023db73f390847ef-e36bc613-4fe540b1-852ba249-ca068c391282bb55ab06ddcc"><ac:plain-text-body><![CDATA[

[ISO/IEC TR 24772:2010

http://www.aitcnet.org/isai/]

"Injection [RST]"

]]></ac:plain-text-body></ac:structured-macro>

MITRE CWE

CWE-116, "Improper Encoding or Escaping of Output"

...

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="7e04625ed9fb83f5-22f2f3fa-46b14e8b-8c9f9a32-9e4bb3081c6b2528f90d1b3e"><ac:plain-text-body><![CDATA[

[[OWASP 2005

AA. Bibliography#OWASP 05]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="47746f453b0f80ed-631e4f98-4c744125-99c49546-592db5ac9f429827c065891a"><ac:plain-text-body><![CDATA[

[[OWASP 2007

AA. Bibliography#OWASP 07]]

 

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="6bf82868228f0701-ff348dcc-49e046d9-9a8195c0-a6810fa3d622dcdb6b900a6d"><ac:plain-text-body><![CDATA[

[[OWASP 2008

AA. Bibliography#OWASP 08]]

[Testing for XML Injection (OWASP-DV-008)

https://www.owasp.org/index.php/Testing_for_XML_Injection_%28OWASP-DV-008%29]

]]></ac:plain-text-body></ac:structured-macro>

<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="a510f99407dce1fb-6b0431e1-4df048c6-b96ebb02-3f04fc8ad9fdd0463ca8422e"><ac:plain-text-body><![CDATA[

[[W3C 2008

AA. Bibliography#W3C 08]]

4.4.3 Included If Validating

]]></ac:plain-text-body></ac:structured-macro>

...