SEI CERT Oracle Coding Standard for Java

Space shortcuts

Page tree

Versions Compared

Old Version 163

changes.mady.by.user Barbara White

Saved on

compared with

New Version 164

changes.mady.by.user Barbara White

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

CVE-2008-2370 describes a vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. When a RequestDispatcher is used, Tomcat performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

Related Guidelines

SEI CERT C Coding Standard

STR02-C. Sanitize data passed to complex subsystems

SEI CERT C++ Coding Standard

STR02-CPP. Sanitize data passed to complex subsystems

SEI CERT Perl Coding StandardIDS33-PL. Sanitize untrusted data passed across a trust boundary

ISO/IEC TR 24772:2013

Injection [RST]

MITRE CWE

CWE-116, Improper encoding or escaping of output

...

This rule uses MS SQL Server as an example to show a database connection. However, on Android, DatabaseHelper from SQLite is used for a database connection. Because Android apps may receive untrusted data via network connections, the rule is applicable.

Bibliography

[OWASP 2005]

A Guide to Building Secure Web Applications and Web Services

[OWASP 2007]

OWASP Top 10 for Java EE

[  Seacord 2015 ]Image result for video icon IDS00-J. Prevent SQL Injection LiveLesson

[W3C 2008]

4.4.3, "Included If Validating"

 

...

Rule 00: Input Validation and Data Sanitization (IDS)      Rule 00: Input Validation and Data Sanitization (IDS)Image Added      Image Added