rspec/rules/S5122/xml/rule.adoc

include::../description.adoc[]

include::../ask-yourself.adoc[]

include::../recommended.adoc[]

== Sensitive Code Example

----
<!-- Tomcat 7+ Cors Filter -->
<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>*</param-value> <!-- Sensitive -->
  </init-param>
</filter>
----

== Compliant Solution

----
<!-- Tomcat 7+ Cors Filter -->
<filter>
  <filter-name>CorsFilter</filter-name>
  <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
  <init-param>
    <param-name>cors.allowed.origins</param-name>
    <param-value>https://trusted1.org,https://trusted2.org</param-value> <!-- Compliant -->
  </init-param>
</filter>
----

include::../see.adoc[]