Skip to content

Commit 3374aaa

Browse files
github-actions[bot]christophe-zurn-sonarsource
github-actions[bot]
and
christophe-zurn-sonarsource
authored
Create rule S2091: add Kotlin (SONARSEC-6213) (#4879)
* Add kotlin to rule S2091 * Add Kotlin rule description; Fix resources links format; Fix and add code examples --------- Co-authored-by: christophe-zurn-sonarsource <[email protected]> Co-authored-by: Christophe Zurn <[email protected]>
1 parent d7b5cda commit 3374aaa

File tree

7 files changed

+140
-6
lines changed

7 files changed

+140
-6
lines changed

‎docs/header_names/allowed_framework_names.adoc‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@
4848
* Java Lang Package
4949
* Java JNDI API
5050
* Java Regex API
51+
* Java XML API
5152
* Jdom2
5253
* JSP
5354
* Legacy Mongo Java API

‎rules/S2091/common/resources/articles.adoc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11
=== Articles & blog posts
22

3-
* https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html#xpath-injection[OWASP, XPath Injection Prevention Cheat Sheet]
4-
* https://web.archive.org/web/20230602194100/https://www.ambionics.io/blog/hacking-watchguard-firewalls[Ambionics, XPath Injection Section of "Hacking WatchGuard Firewalls']
3+
* OWASP - https://cheatsheetseries.owasp.org/cheatsheets/Injection_Prevention_Cheat_Sheet.html#xpath-injection[XPath Injection Prevention Cheat Sheet]
4+
* Ambionics - https://web.archive.org/web/20230602194100/https://www.ambionics.io/blog/hacking-watchguard-firewalls[XPath Injection Section of "Hacking WatchGuard Firewalls']

rules/S2091/java/how-to-fix-it/java-se.adoc renamed to rules/S2091/java/how-to-fix-it/java-xml.adoc

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
== How to fix it in Java SE
1+
== How to fix it in Java XML API
22

33
=== Code examples
44

@@ -9,7 +9,10 @@ concatenated to an XPath query without prior validation.
99

1010
[source,java,diff-id=1,diff-type=noncompliant]
1111
----
12-
public boolean authenticate(HttpServletRequest req, XPath xpath, Document doc) throws XPathExpressionException {
12+
import javax.xml.xpath.XPath;
13+
import javax.xml.xpath.XPathConstants;
14+
15+
public boolean authenticate(HttpServletRequest request, XPath xpath, Document doc) throws XPathExpressionException {
1316
String user = request.getParameter("user");
1417
String pass = request.getParameter("pass");
1518
@@ -23,7 +26,11 @@ public boolean authenticate(HttpServletRequest req, XPath xpath, Document doc) t
2326

2427
[source,java,diff-id=1,diff-type=compliant]
2528
----
26-
public boolean authenticate(HttpServletRequest req, XPath xpath, Document doc) throws XPathExpressionException {
29+
import javax.xml.xpath.XPath;
30+
import javax.xml.xpath.XPathConstants;
31+
import javax.xml.xpath.XPathVariableResolver;
32+
33+
public boolean authenticate(HttpServletRequest request, XPath xpath, Document doc) throws XPathExpressionException {
2734
String user = request.getParameter("user");
2835
String pass = request.getParameter("pass");
2936

‎rules/S2091/java/rule.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ include::../impact.adoc[]
66

77
// How to fix it section
88

9-
include::how-to-fix-it/java-se.adoc[]
9+
include::how-to-fix-it/java-xml.adoc[]
1010

1111
== Resources
1212

‎rules/S2091/kotlin/how-to-fix-it/java-xml.adoc‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
== How to fix it in Java XML API
2+
3+
=== Code examples
4+
5+
The following noncompliant code is vulnerable to XPath injections because untrusted data is
6+
concatenated to an XPath query without prior validation.
7+
8+
==== Noncompliant code example
9+
10+
[source,kotlin,diff-id=1,diff-type=noncompliant]
11+
----
12+
import javax.xml.xpath.XPath
13+
import javax.xml.xpath.XPathConstants
14+
15+
fun authenticate(request: HttpServletRequest, xpath: XPath, doc: Document): Boolean {
16+
val user: String = request.getParameter("user")
17+
val pass: String = request.getParameter("pass")
18+
val expression = "/users/user[@name='$user' and @pass='$pass']"
19+
return xpath.evaluate(expression, doc, XPathConstants.BOOLEAN) as Boolean
20+
}
21+
----
22+
23+
==== Compliant solution
24+
25+
[source,kotlin,diff-id=1,diff-type=compliant]
26+
----
27+
import javax.xml.xpath.XPath
28+
import javax.xml.xpath.XPathConstants
29+
import javax.xml.xpath.XPathVariableResolver
30+
31+
fun authenticate(request: HttpServletRequest, xpath: XPath, doc: Document?): Boolean {
32+
val user = request.getParameter("user")
33+
val pass = request.getParameter("pass")
34+
val expression = "/users/user[@name=\$user and @pass=\$pass]"
35+
xpath.xPathVariableResolver = XPathVariableResolver { v: QName ->
36+
when (v.localPart) {
37+
"user" -> return@XPathVariableResolver user
38+
"pass" -> return@XPathVariableResolver pass
39+
else -> throw IllegalArgumentException()
40+
}
41+
}
42+
return xpath.evaluate(expression, doc, XPathConstants.BOOLEAN) as Boolean
43+
}
44+
----
45+
46+
=== How does this work?
47+
48+
As a rule of thumb, the best approach to protect against injections is to
49+
systematically ensure that untrusted data cannot break out of the initially
50+
intended logic.
51+
52+
include::../../common/fix/parameterized-queries.adoc[]
53+
54+
In the example, a parameterized XPath query is created, and an `XPathVariableResolver` is used to securely insert untrusted data into the query, similar to parameterized SQL queries.
55+
56+
include::../../common/fix/validation.adoc[]
57+
58+
For Java, OWASP's Enterprise Security API offers https://www.javadoc.io/doc/org.owasp.esapi/esapi/latest/org/owasp/esapi/Encoder.html#encodeForXPath-java.lang.String-[`encodeForXPath`] which sanitizes metacharacters automatically.

‎rules/S2091/kotlin/metadata.json‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
{
2+
"tags": [
3+
"cwe",
4+
"cert"
5+
],
6+
"securityStandards": {
7+
"CERT": [
8+
"IDS53-J."
9+
],
10+
"CWE": [
11+
20,
12+
643
13+
],
14+
"OWASP": [
15+
"A1"
16+
],
17+
"OWASP Top 10 2021": [
18+
"A3"
19+
],
20+
"PCI DSS 3.2": [
21+
"6.5.1"
22+
],
23+
"PCI DSS 4.0": [
24+
"6.2.4"
25+
],
26+
"ASVS 4.0": [
27+
"5.1.3",
28+
"5.1.4",
29+
"5.3.10"
30+
],
31+
"STIG ASD_V5R3": [
32+
"V-222608",
33+
"V-222609"
34+
]
35+
}
36+
}

‎rules/S2091/kotlin/rule.adoc‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
== Why is this an issue?
2+
3+
include::../rationale.adoc[]
4+
5+
include::../impact.adoc[]
6+
7+
// How to fix it section
8+
9+
include::how-to-fix-it/java-xml.adoc[]
10+
11+
== Resources
12+
13+
include::../common/resources/articles.adoc[]
14+
15+
include::../common/resources/standards.adoc[]
16+
17+
ifdef::env-github,rspecator-view[]
18+
19+
'''
20+
== Implementation Specification
21+
(visible only on this page)
22+
23+
include::../message.adoc[]
24+
25+
'''
26+
== Comments And Links
27+
(visible only on this page)
28+
29+
include::../comments-and-links.adoc[]
30+
31+
endif::env-github,rspecator-view[]
32+

0 commit comments

Comments
 (0)