16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
71 lines
2.0 KiB
Plaintext
71 lines
2.0 KiB
Plaintext
== Why is this an issue?
|
|
|
|
Every filter defined in ``++web.xml++`` file should be used in a ``++<filter-mapping>++`` element. Otherwise such filters are not invoked.
|
|
|
|
|
|
=== Noncompliant code example
|
|
|
|
[source,xml]
|
|
----
|
|
<filter>
|
|
<filter-name>DefinedNotUsed</filter-name>
|
|
<filter-class>com.myco.servlet.ValidationFilter</filter-class>
|
|
</filter>
|
|
----
|
|
|
|
|
|
=== Compliant solution
|
|
|
|
[source,xml]
|
|
----
|
|
<filter>
|
|
<filter-name>ValidationFilter</filter-name>
|
|
<filter-class>com.myco.servlet.ValidationFilter</filter-class>
|
|
</filter>
|
|
|
|
<filter-mapping>
|
|
<filter-name>ValidationFilter</filter-name>
|
|
<url-pattern>/*</url-pattern>
|
|
</filter-mapping>
|
|
----
|
|
|
|
|
|
== Resources
|
|
|
|
* https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[OWASP Top 10 2021 Category A5] - Security Misconfiguration
|
|
* https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[OWASP Top 10 2017 Category A6] - Security Misconfiguration
|
|
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* "xxx" filter should have a mapping.
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 2 Oct 2015, 19:13:58 Ann Campbell wrote:
|
|
\[~nicolas.peru], I know we're not ready to check ``++web.xml++`` yet, but when we are...
|
|
|
|
=== on 4 Mar 2016, 12:32:16 sytze van koningsveld wrote:
|
|
scrubbing sounds like blacklisting, which is different from true validation (white listing), so maybe a misnomer. The "validation filter" should not replace true valdation, typically done in controllers.
|
|
|
|
=== on 19 Mar 2018, 09:56:33 Sébastien GIORIA - AppSecFR wrote:
|
|
I might tag this OWASP A6:2017 and not A1:2017. This is not a injection, more a configuration problem
|
|
|
|
=== on 20 Mar 2018, 07:22:40 Freddy Mallet wrote:
|
|
I tend to agree with [~SPoint]. [~alexandre.gigleux] would you be confortable with this change ? Thanks
|
|
|
|
=== on 20 Mar 2018, 08:16:15 Alexandre Gigleux wrote:
|
|
I agree [~freddy.mallet] / [~SPoint] and I applied the suggested change.
|
|
|
|
endif::env-github,rspecator-view[]
|