hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Java: Tweak qhelp to make it markdown-compatible.

Browse Source
This commit is contained in:
Anders Schack-Mulligen
2020-10-29 14:39:01 +01:00
parent fa344d216f
commit 0d926dcf70
1 changed files with 14 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
java/ql/src/Security/CWE/CWE-094/InsecureBeanValidation.qhelp
View File

@@ -15,21 +15,25 @@ untrusted) bean properties flow into the custom error message.</p>
<ul>
<li>Do not include validated bean properties in the custom error message.</li>
<li>Use parameterized messages instead of string concatenation. For example:
<pre>
HibernateConstraintValidatorContext context = constraintValidatorContext.unwrap( HibernateConstraintValidatorContext.class );
context.addMessageParameter( "foo", "bar" );
context.buildConstraintViolationWithTemplate( "My violation message contains a parameter {foo}").addConstraintViolation();
</pre></li>
</li>
</ul>
<pre>HibernateConstraintValidatorContext context =
constraintValidatorContext.unwrap(HibernateConstraintValidatorContext.class);
context.addMessageParameter("foo", "bar");
context.buildConstraintViolationWithTemplate("My violation message contains a parameter {foo}")
.addConstraintViolation();</pre>
<ul>
<li>Sanitize the validated bean properties to make sure that there are no EL expressions.
An example of valid sanitization logic can be found <a href="https://github.com/hibernate/hibernate-validator/blob/master/engine/src/main/java/org/hibernate/validator/internal/engine/messageinterpolation/util/InterpolationHelper.java#L17">here</a>.</li>
<li>Disable the EL interpolation and only use <code>ParameterMessageInterpolator</code>:
<pre>
Validator validator = Validation.byDefaultProvider()
</li>
</ul>
<pre>Validator validator = Validation.byDefaultProvider()
.configure()
.messageInterpolator( new ParameterMessageInterpolator() )
.messageInterpolator(new ParameterMessageInterpolator())
.buildValidatorFactory()
.getValidator();
</pre></li>
.getValidator();</pre>
<ul>
<li>Replace Hibernate Validator with Apache BVal, which in its latest version does not interpolate EL expressions by default.
Note that this replacement may not be a simple drop-in replacement.</li>
</ul>