9ee16daa47
* Update JSON schema to include STIG ASD 2023-06-08 mapping * Update rules to add STIG metadata mappings --------- Co-authored-by: Loris Sierra <loris.sierra@sonarsource.com>
93 lines
3.7 KiB
Plaintext
93 lines
3.7 KiB
Plaintext
include::../description.adoc[]
|
|
|
|
include::../ask-yourself.adoc[]
|
|
|
|
include::../recommended.adoc[]
|
|
|
|
== Sensitive Code Example
|
|
|
|
----
|
|
public void setPermissions(String filePath) {
|
|
Set<PosixFilePermission> perms = new HashSet<PosixFilePermission>();
|
|
// user permission
|
|
perms.add(PosixFilePermission.OWNER_READ);
|
|
perms.add(PosixFilePermission.OWNER_WRITE);
|
|
perms.add(PosixFilePermission.OWNER_EXECUTE);
|
|
// group permissions
|
|
perms.add(PosixFilePermission.GROUP_READ);
|
|
perms.add(PosixFilePermission.GROUP_EXECUTE);
|
|
// others permissions
|
|
perms.add(PosixFilePermission.OTHERS_READ); // Sensitive
|
|
perms.add(PosixFilePermission.OTHERS_WRITE); // Sensitive
|
|
perms.add(PosixFilePermission.OTHERS_EXECUTE); // Sensitive
|
|
|
|
Files.setPosixFilePermissions(Paths.get(filePath), perms);
|
|
}
|
|
----
|
|
|
|
----
|
|
public void setPermissionsUsingRuntimeExec(String filePath) {
|
|
Runtime.getRuntime().exec("chmod 777 file.json"); // Sensitive
|
|
}
|
|
----
|
|
|
|
----
|
|
public void setOthersPermissionsHardCoded(String filePath ) {
|
|
Files.setPosixFilePermissions(Paths.get(filePath), PosixFilePermissions.fromString("rwxrwxrwx")); // Sensitive
|
|
}
|
|
----
|
|
|
|
== Compliant Solution
|
|
|
|
On operating systems that implement POSIX standard. This will throw a ``++UnsupportedOperationException++`` on Windows.
|
|
|
|
|
|
[source,java]
|
|
----
|
|
public void setPermissionsSafe(String filePath) throws IOException {
|
|
Set<PosixFilePermission> perms = new HashSet<PosixFilePermission>();
|
|
// user permission
|
|
perms.add(PosixFilePermission.OWNER_READ);
|
|
perms.add(PosixFilePermission.OWNER_WRITE);
|
|
perms.add(PosixFilePermission.OWNER_EXECUTE);
|
|
// group permissions
|
|
perms.add(PosixFilePermission.GROUP_READ);
|
|
perms.add(PosixFilePermission.GROUP_EXECUTE);
|
|
// others permissions removed
|
|
perms.remove(PosixFilePermission.OTHERS_READ); // Compliant
|
|
perms.remove(PosixFilePermission.OTHERS_WRITE); // Compliant
|
|
perms.remove(PosixFilePermission.OTHERS_EXECUTE); // Compliant
|
|
|
|
Files.setPosixFilePermissions(Paths.get(filePath), perms);
|
|
}
|
|
----
|
|
|
|
== See
|
|
|
|
* OWASP - https://owasp.org/Top10/A01_2021-Broken_Access_Control/[Top 10 2021 Category A1 - Broken Access Control]
|
|
* OWASP - https://owasp.org/Top10/A04_2021-Insecure_Design/[Top 10 2021 Category A4 - Insecure Design]
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A5_2017-Broken_Access_Control[Top 10 2017 Category A5 - Broken Access Control]
|
|
* https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/02-Configuration_and_Deployment_Management_Testing/09-Test_File_Permission[OWASP File Permission]
|
|
* CWE - https://cwe.mitre.org/data/definitions/732[CWE-732 - Incorrect Permission Assignment for Critical Resource]
|
|
* CWE - https://cwe.mitre.org/data/definitions/266[CWE-266 - Incorrect Privilege Assignment]
|
|
* https://wiki.sei.cmu.edu/confluence/display/java/FIO01-J.+Create+files+with+appropriate+access+permissions[CERT, FIO01-J.] - Create files with appropriate access permissions
|
|
* https://wiki.sei.cmu.edu/confluence/display/c/FIO06-C.+Create+files+with+appropriate+access+permissions[CERT, FIO06-C.] - Create files with appropriate access permissions
|
|
* STIG Viewer - https://stigviewer.com/stig/application_security_and_development/2023-06-08/finding/V-222430[Application Security and Development: V-222430] - The application must execute without excessive account permissions.
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::../message.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::../comments-and-links.adoc[]
|
|
|
|
endif::env-github,rspecator-view[]
|