14 lines
800 B
Plaintext
14 lines
800 B
Plaintext
Sending HTTP requests is security-sensitive. It has led in the past to the following vulnerabilities:
|
|
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8150[CVE-2014-8150]
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000007[CVE-2018-1000007]
|
|
* http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0660[CVE-2010-0660]
|
|
|
|
An HTTP request has different kinds of vulnerabilities:
|
|
|
|
* it sends data which might be intercepted or dangerous.
|
|
* it receives a response which might have been crafted by an attacker.
|
|
* as each request opens a socket and triggers some processing for the sender and the recipient, it is possible to exhaust resources on both sides by sending too many requests.
|
|
|
|
This rule flags code that initiates an HTTP request. The goal is to guide security code reviews.
|