== Why is this an issue?

Cookie values and the contents of form fields - both visible _and_ hidden - can easily be manipulated by attackers. Therefore, security decisions should not be made based on these inputs. 


This rule logs an issue whenever form fields and cookie values are accessed.


=== Noncompliant code example

[source,text]
----
public void doPost(HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException {
  Cookie [] cookies = request.getCookies(); // Noncompliant
  String hiddenValue = request.getParameter("hiddenField"); // Noncompliant
  Map<String,String[]> params = request.getParameterMap(); // Noncompliant
  String [] hiddenFieldValues = reqeust.getParameterValues("hiddenArray");  // Noncompliant
----


== Resources

* https://owasp.org/Top10/A04_2021-Insecure_Design/[OWASP Top 10 2021 Category A4] - Insecure Design
* https://cwe.mitre.org/data/definitions/807[MITRE, CWE-807] - Reliance on Untrusted Inputs in a Security Decision
* https://www.sans.org/top25-software-errors/#cat3[SANS Top 25] - Porous Defenses