36 lines
963 B
Plaintext
36 lines
963 B
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
@RequestMapping("/delete_user") // Sensitive: by default all HTTP methods are allowed
|
|
public String delete1(String username) {
|
|
// state of the application will be changed here
|
|
}
|
|
|
|
@RequestMapping(path = "/delete_user", method = {RequestMethod.GET, RequestMethod.POST}) // Sensitive: both safe and unsafe methods are allowed
|
|
String delete2(@RequestParam("id") String id) {
|
|
// state of the application will be changed here
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
----
|
|
@RequestMapping("/delete_user", method = RequestMethod.POST) // Compliant
|
|
public String delete1(String username) {
|
|
// state of the application will be changed here
|
|
}
|
|
|
|
@RequestMapping(path = "/delete_user", method = RequestMethod.POST) // Compliant
|
|
String delete2(@RequestParam("id") String id) {
|
|
// state of the application will be changed here
|
|
}
|
|
----
|
|
|
|
include::../see.adoc[]
|