44 lines
1.3 KiB
Plaintext
44 lines
1.3 KiB
Plaintext
|
include::../description.adoc[]
|
||
|
|
|
||
|
|
== Noncompliant Code Example
|
||
|
|
|
||
|
|
----
|
||
|
|
public boolean authenticate(javax.servlet.http.HttpServletRequest request, javax.xml.xpath.XPath xpath, org.w3c.dom.Document doc) throws XPathExpressionException {
|
||
|
|
String user = request.getParameter("user");
|
||
|
|
String pass = request.getParameter("pass");
|
||
|
|
|
||
|
|
String expression = "/users/user[@name='" + user + "' and @pass='" + pass + "']"; // Unsafe
|
||
|
|
|
||
|
|
// An attacker can bypass authentication by setting user to this special value
|
||
|
|
user = "' or 1=1 or ''='";
|
||
|
|
|
||
|
|
return (boolean)xpath.evaluate(expression, doc, XPathConstants.BOOLEAN); // Noncompliant
|
||
|
|
}
|
||
|
|
----
|
||
|
|
|
||
|
|
== Compliant Solution
|
||
|
|
|
||
|
|
----
|
||
|
|
public boolean authenticate(javax.servlet.http.HttpServletRequest request, javax.xml.xpath.XPath xpath, org.w3c.dom.Document doc) throws XPathExpressionException {
|
||
|
|
String user = request.getParameter("user");
|
||
|
|
String pass = request.getParameter("pass");
|
||
|
|
|
||
|
|
String expression = "/users/user[@name=$user and @pass=$pass]";
|
||
|
|
|
||
|
|
xpath.setXPathVariableResolver(v -> {
|
||
|
|
switch (v.getLocalPart()) {
|
||
|
|
case "user":
|
||
|
|
return user;
|
||
|
|
case "pass":
|
||
|
|
return pass;
|
||
|
|
default:
|
||
|
|
throw new IllegalArgumentException();
|
||
|
|
}
|
||
|
|
});
|
||
|
|
|
||
|
|
return (boolean)xpath.evaluate(expression, doc, XPathConstants.BOOLEAN);
|
||
|
|
}
|
||
|
|
----
|
||
|
|
|
||
|
|
include::../see.adoc[]
|