hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2025-12-24 04:36:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

Add check for disabled CSRF protection in Spring

Browse Source 
Fix help and correct formatting.
This commit is contained in:
Grzegorz Golawski
2020-01-22 21:27:34 +01:00
parent c5a974788b
commit 5596944926
2 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.qhelp
View File

@@ -10,7 +10,7 @@ result in exposure of data or unintended code execution.</p>
</overview>
<recommendation>
<p>Cross-Site Request Forgery (CSRF) protection is enabled by default. Spring's recommendation
<p>When you use Spring, Cross-Site Request Forgery (CSRF) protection is enabled by default. Spring's recommendation
is to use CSRF protection for any request that could be processed by a browser client by normal
users.</p>
</recommendation>

8
java/ql/src/Security/CWE/CWE-352/SpringCSRFProtection.ql
View File

@@ -15,8 +15,8 @@ import java
from MethodAccess call
where
call.getMethod().hasName("disable") and
call.getReceiverType().hasQualifiedName(
"org.springframework.security.config.annotation.web.configurers",
"CsrfConfigurer<HttpSecurity>"
)
call
.getReceiverType()
.hasQualifiedName("org.springframework.security.config.annotation.web.configurers",
"CsrfConfigurer<HttpSecurity>")
select call, "CSRF vulnerability due to protection being disabled."