== Why is this an issue?

Every filter defined in ``++web.xml++`` file should be used in a ``++<filter-mapping>++`` element. Otherwise such filters are not invoked.


=== Noncompliant code example

[source,xml]
----
  <filter>
     <filter-name>DefinedNotUsed</filter-name>
     <filter-class>com.myco.servlet.ValidationFilter</filter-class>
  </filter>
----


=== Compliant solution

[source,xml]
----
  <filter>
     <filter-name>ValidationFilter</filter-name>
     <filter-class>com.myco.servlet.ValidationFilter</filter-class>
  </filter>

  <filter-mapping>
     <filter-name>ValidationFilter</filter-name>
     <url-pattern>/*</url-pattern>
  </filter-mapping>
----


== Resources

* https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[OWASP Top 10 2021 Category A5] - Security Misconfiguration
* https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[OWASP Top 10 2017 Category A6] - Security Misconfiguration



ifdef::env-github,rspecator-view[]

'''
== Implementation Specification
(visible only on this page)

=== Message

* "xxx" filter should have a mapping.


'''
== Comments And Links
(visible only on this page)

=== on 2 Oct 2015, 19:13:58 Ann Campbell wrote:
\[~nicolas.peru], I know we're not ready to check ``++web.xml++`` yet, but when we are...

=== on 4 Mar 2016, 12:32:16 sytze van koningsveld wrote:
scrubbing sounds like blacklisting, which is different from true validation (white listing), so maybe a misnomer. The "validation filter" should not replace true valdation, typically done in controllers.

=== on 19 Mar 2018, 09:56:33 Sébastien GIORIA - AppSecFR wrote:
I might tag this OWASP A6:2017 and not A1:2017. This is not a injection, more a configuration problem

=== on 20 Mar 2018, 07:22:40 Freddy Mallet wrote:
I tend to agree with [~SPoint]. [~alexandre.gigleux] would you be confortable with this change ? Thanks

=== on 20 Mar 2018, 08:16:15 Alexandre Gigleux wrote:
I agree [~freddy.mallet] / [~SPoint] and I applied the suggested change.

endif::env-github,rspecator-view[]