hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-27 01:35:13 +02:00
Code Issues Packages Projects Releases Wiki Activity

Trust Boundary Work

Browse Source
This commit is contained in:
Ed Minnix
2023-07-19 16:39:09 -04:00
parent 2aba425464
commit f58590c6a9
5 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
java/ql/src/Security/CWE/CWE-501/TrustBoundaryViolation.qhelp Normal file
View File

@@ -0,0 +1,39 @@
<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
<overview>
<p>
A trust boundary violation occurs when a value is passed from a less trusted context to a more trusted context.
</p>
<p>
For example, a value that is generated by a less trusted source, such as a user, may be passed to a more trusted
source, such as a system process. If the less trusted source is malicious, then the value may be crafted to
exploit the more trusted source.
</p>
<p>
Trust boundary violations are often caused by a failure to validate input. For example, if a web application
accepts a cookie from a user, then the application should validate the cookie before using it. If the cookie is
not validated, then the user may be able to craft a malicious cookie that exploits the application.
</p>
</overview>
<recommendation>
<p>
Validate input coming from a user. For example, if a web application accepts a cookie from a user, then the
application should validate the cookie before using it.
</p>
</recommendation>
<example>
</example>
<references>
<li>
Wikipedia: <a href="http://en.wikipedia.org/wiki/Trust_boundary">Trust boundary</a>.
</li>
</references>
</qhelp>