16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
80 lines
2.1 KiB
Plaintext
80 lines
2.1 KiB
Plaintext
== Why is this an issue?
|
|
|
|
Default interceptors, such as application security interceptors, must be listed in the ``++ejb-jar.xml++`` file, or they will not be treated as default.
|
|
|
|
|
|
This rule applies to projects that contain JEE Beans (any one of ``++javax.ejb.Singleton++``, ``++MessageDriven++``, ``++Stateless++`` or ``++Stateful++``).
|
|
|
|
|
|
=== Noncompliant code example
|
|
|
|
[source,xml]
|
|
----
|
|
// file: ejb-interceptors.xml
|
|
<assembly-descriptor>
|
|
<interceptor-binding> <!-- should be declared in ejb-jar.xml -->
|
|
<ejb-name>*</ejb-name>
|
|
<interceptor-class>com.myco.ImportantInterceptor</interceptor-class> <!-- Noncompliant; will NOT be treated as default -->
|
|
</interceptor-binding>
|
|
</assembly-descriptor>
|
|
----
|
|
|
|
|
|
=== Compliant solution
|
|
|
|
[source,xml]
|
|
----
|
|
// file: ejb-jar.xml
|
|
<assembly-descriptor>
|
|
<interceptor-binding>
|
|
<ejb-name>*</ejb-name>
|
|
<interceptor-class>com.myco.ImportantInterceptor</interceptor-class>
|
|
</interceptor-binding>
|
|
</assembly-descriptor>
|
|
----
|
|
|
|
|
|
== Resources
|
|
|
|
* https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[OWASP Top 10 2021 Category A5] - Security Misconfiguration
|
|
* https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[OWASP Top 10 2017 Category A6] - Security Misconfiguration
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Move this default interceptor to "ejb-jar.xml"
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 23 Jul 2015, 13:02:01 Ann Campbell wrote:
|
|
Rule origin: \https://groups.google.com/forum/#!topic/sonarqube/cYQdBhf00eo
|
|
|
|
|
|
Project is EJB if it contains JEE Beans (any one of javax.ejb.Singleton, MessageDriven, Stateless or Stateful) (@Local/@Remote interfaces are not mandatory)
|
|
|
|
|
|
|
|
|
|
=== on 30 Jul 2015, 13:04:52 Nicolas Peru wrote:
|
|
Your comment should probably be part of the rule description. Otherwise looks good.
|
|
|
|
=== on 30 Jul 2015, 14:01:39 Ann Campbell wrote:
|
|
done [~nicolas.peru]
|
|
|
|
=== on 19 Mar 2018, 09:54:11 Sébastien GIORIA - AppSecFR wrote:
|
|
Could be tagged OWASP A6:2017
|
|
|
|
=== on 20 Mar 2018, 07:24:20 Freddy Mallet wrote:
|
|
Done [~SPoint], thanks !
|
|
|
|
endif::env-github,rspecator-view[]
|