Java: add some improvements to the bean validation query#4629
Merged
adityasharad merged 7 commits intoNov 17, 2020
Conversation
RasmusWL
changed the title
adityasharad
reviewed
Nov 9, 2020
Collaborator
adityasharad
left a comment
adityasharad
left a comment
There was a problem hiding this comment.
Structure looks good! Added suggestions for handling false negatives, as discussed separately.
…, or there is at least one that is insecure
adityasharad
approved these changes
Nov 12, 2020
Collaborator
adityasharad
left a comment
adityasharad
left a comment
There was a problem hiding this comment.
LGTM. @aschackmull or @smowton do you have any further comments?
Contributor
|
Nothing from me, but I don't have much of the background on this one |
Contributor
Author
|
@aschackmull can we merge this one so we remove some relevant FPs? thanks! |
adityasharad
approved these changes
Nov 17, 2020
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This improvements try to address those cases where the vulnerability is fixed by setting a default message interpolator that does not interpolate Expression Language expressions.
This can lead to False negatives though since it may be the case where the project scanned has more than one application and the secure configuration may not be applied to all of them. Because we are just checking that there is a call to
setMessasgeInterpolatorwith a non-EL interpolator somewhere in the scanned code, we may consider that it protects all the uses of Bean validation which may not be the case.In the opposite hand, if we do not apply an improvement like this, projects fixing the issue with this approach (which is the recommended one) will not get rid of the alert.
/cc @adityasharad