hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-30 03:05:15 +02:00
Code Issues Packages Projects Releases Wiki Activity

Update and rename ComparingValueOfSensetiveHeader.java to Test.java

Browse Source
This commit is contained in:
Ahmed Farid
2022-02-25 15:39:50 +01:00
committed by Chris Smowton
parent 091227982c
commit 35abc3f9a3
2 changed files with 20 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
java/ql/src/experimental/Security/CWE/CWE-208/ComparingValueOfSensetiveHeader.java
View File

@@ -1,17 +0,0 @@
import javax.servlet.http.HttpServletRequest;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
private boolean UnsafecsrfComparison(String csrfTokenInCookie) {
if(csrfTokenInCookie == null || !csrfTokenInCookie.equals(request.getHeader("X-CSRF-TOKEN"))) { // BAD
return false;
}
}
private boolean safecsrfComparison(String csrfTokenInCookie) {
String csrfTokenInRequest = request.getHeader("X-CSRF-TOKEN");
if (csrfTokenInRequest == null || !MessageDigest.isEqual(
csrfTokenInCookie.getBytes(StandardCharsets.UTF_8),
csrfTokenInRequest.getBytes(StandardCharsets.UTF_8))) { // GOOD
return false;
}
}

20
java/ql/src/experimental/Security/CWE/CWE-208/Test.java Normal file
View File

@@ -0,0 +1,20 @@
import javax.servlet.http.HttpServletRequest;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.lang.String;
public class Test {
private boolean UnsafeComparison(HttpServletRequest request) {
String Key = "secret";
return Key.equals(request.getHeader("X-Auth-Token"));
}
private boolean safeComparison(HttpServletRequest request) {
String token = request.getHeader("X-Auth-Token");
String Key = "secret";
return MessageDigest.isEqual(Key.getBytes(StandardCharsets.UTF_8), token.getBytes(StandardCharsets.UTF_8));
}
}