66 lines
1.9 KiB
Plaintext
66 lines
1.9 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
== Noncompliant Code Example
|
|
|
|
[source,java]
|
|
----
|
|
public boolean authenticate(javax.servlet.http.HttpServletRequest request, javax.xml.xpath.XPath xpath, org.w3c.dom.Document doc) throws XPathExpressionException {
|
|
String user = request.getParameter("user");
|
|
String pass = request.getParameter("pass");
|
|
|
|
String expression = "/users/user[@name='" + user + "' and @pass='" + pass + "']"; // Unsafe
|
|
|
|
// An attacker can bypass authentication by setting user to this special value
|
|
user = "' or 1=1 or ''='";
|
|
|
|
return (boolean)xpath.evaluate(expression, doc, XPathConstants.BOOLEAN); // Noncompliant
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
[source,java]
|
|
----
|
|
public boolean authenticate(javax.servlet.http.HttpServletRequest request, javax.xml.xpath.XPath xpath, org.w3c.dom.Document doc) throws XPathExpressionException {
|
|
String user = request.getParameter("user");
|
|
String pass = request.getParameter("pass");
|
|
|
|
String expression = "/users/user[@name=$user and @pass=$pass]";
|
|
|
|
xpath.setXPathVariableResolver(v -> {
|
|
switch (v.getLocalPart()) {
|
|
case "user":
|
|
return user;
|
|
case "pass":
|
|
return pass;
|
|
default:
|
|
throw new IllegalArgumentException();
|
|
}
|
|
});
|
|
|
|
return (boolean)xpath.evaluate(expression, doc, XPathConstants.BOOLEAN);
|
|
}
|
|
----
|
|
|
|
== See
|
|
|
|
* https://owasp.org/Top10/A03_2021-Injection/[OWASP Top 10 2021 Category A3] - Injection
|
|
* https://owasp.org/www-project-top-ten/2017/A1_2017-Injection[OWASP Top 10 2017 Category A1] - Injection
|
|
* https://cwe.mitre.org/data/definitions/643[MITRE, CWE-643] - Improper Neutralization of Data within XPath Expressions
|
|
* https://wiki.sei.cmu.edu/confluence/x/cDZGBQ[CERT, IDS53-J.] - Prevent XPath Injection
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
endif::env-github,rspecator-view[]
|