hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-05-01 11:45:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Create ComparingValueOfSensetiveHeader.java

Browse Source
This commit is contained in:
ahmed532009
2022-02-11 16:45:01 +01:00
committed by Chris Smowton
parent aa488e532f
commit a0a1c587e5
1 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
java/ql/test/experimental/query-tests/security/CWE-208/ComparingValueOfSensetiveHeader.java Normal file
View File

@@ -0,0 +1,20 @@
import javax.servlet.http.HttpServletRequest;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
private boolean UnsafecsrfComparison(String csrfTokenInCookie) {
if(csrfTokenInCookie == null || !csrfTokenInCookie.equals(request.getHeader("X-CSRF-TOKEN"))) { // BAD
return false;
}
}
private boolean safecsrfComparison(String csrfTokenInCookie) {
String csrfTokenInRequest = request.getHeader("X-CSRF-TOKEN");
if (csrfTokenInRequest == null || !MessageDigest.isEqual(
csrfTokenInCookie.getBytes(StandardCharsets.UTF_8),
csrfTokenInRequest.getBytes(StandardCharsets.UTF_8))) { // GOOD
return false;
}
}