16f6c0aecf
Inline adoc files when they are included exactly once. Also fix language tags because this inlining gives us better information on what language the code is written in.
62 lines
2.0 KiB
Plaintext
62 lines
2.0 KiB
Plaintext
== Why is this an issue?
|
|
|
|
There is no reason to have a ``++main++`` method in a web application. It may have been useful for debugging during application development, but such a method should never make it into production. Having a ``++main++`` method in a web application opens a door to the application logic that an attacker may never be able to reach (but watch out if one does!), but it is a sloppy practice and indicates that other problems may be present.
|
|
|
|
|
|
This rule raises an issue when a ``++main++`` method is found in a servlet or an EJB.
|
|
|
|
|
|
=== Noncompliant code example
|
|
|
|
[source,java]
|
|
----
|
|
public class MyServlet extends HttpServlet {
|
|
public void doGet(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
|
|
if (userIsAuthorized(req)) {
|
|
updatePrices(req);
|
|
}
|
|
}
|
|
|
|
public static void main(String[] args) { // Noncompliant
|
|
updatePrices(req);
|
|
}
|
|
}
|
|
----
|
|
|
|
|
|
== Resources
|
|
|
|
* https://www.owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure
|
|
* https://cwe.mitre.org/data/definitions/489[MITRE, CWE-489] - Active Debug Code
|
|
* https://wiki.sei.cmu.edu/confluence/x/qzVGBQ[CERT, ENV06-J.] - Production code must not contain debugging entry points
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
Remove this unwanted "main" method.
|
|
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
=== on 8 Apr 2015, 15:03:33 Nicolas Peru wrote:
|
|
\[~ann.campbell.2]From example, I have no idea why this could be a security threat. And I am not sure which main methods we are supposed to detect ? the ones defined in Servlet classes ? if yes, this should be specified.
|
|
|
|
=== on 8 Apr 2015, 18:58:52 Ann Campbell wrote:
|
|
How's it look now, [~nicolas.peru]?
|
|
|
|
=== on 9 Apr 2015, 07:37:22 Nicolas Peru wrote:
|
|
\[~ann.campbell.2] looks ok !
|
|
|
|
=== on 12 Jun 2015, 13:09:22 Ann Campbell wrote:
|
|
CodePro: Illegal Main Method
|
|
|
|
endif::env-github,rspecator-view[]
|