1ad5902a8d
## Review A dedicated reviewer checked the rule description successfully for: - [ ] logical errors and incorrect information - [ ] information gaps and missing content - [ ] text style and tone - [ ] PR summary and labels follow [the guidelines](https://github.com/SonarSource/rspec/#to-modify-an-existing-rule) --------- Co-authored-by: Sebastien Andrivet <138577785+sebastien-andrivet-sonarsource@users.noreply.github.com>
95 lines
2.8 KiB
Plaintext
95 lines
2.8 KiB
Plaintext
This vulnerability exposes the application to failures of a wide range of
|
|
application-specific features the Strut filter was supposed to perform, such as
|
|
authentication, logging, encryption, and more.
|
|
|
|
== Why is this an issue?
|
|
|
|
Filters are used to intercept requests and responses from a server and allow
|
|
developers to manipulate them. When a `filter` is declared, but the
|
|
corresponding `filter assignment` is inadvertently not, then the code is
|
|
vulnerable to security problems or business logic instability.
|
|
|
|
If a filter is defined in the web application descriptor file `web.xml` but is
|
|
not used in a "filter mapping", this is an indication that it may have been
|
|
forgotten.
|
|
|
|
=== What is the potential impact?
|
|
|
|
If a filter is not used in a ``++<filter-mapping>++`` element, it will not be
|
|
called. Below are some examples of the impact of this oversight.
|
|
|
|
==== Unauthorized access
|
|
|
|
One of the main uses of Struts filters is to provide security measures such as
|
|
authentication and authorization. If a filter is forgotten in the filter
|
|
mappings, unauthorized users could gain access to sensitive data or perform
|
|
actions that they are not authorized to perform.
|
|
|
|
==== Functional problems
|
|
|
|
Filters can also be used to modify requests and responses, format data, or even
|
|
handle errors. If these features are not included in the filter mappings, they
|
|
may not work as expected, resulting in a poor user experience or even
|
|
application crash.
|
|
|
|
==== Performance issues
|
|
|
|
Some filters are designed to improve the performance of your application, such
|
|
as those that implement caching strategies. If these are not mapped, you may
|
|
experience slow response times or increased server load on your application.
|
|
|
|
== How to fix it
|
|
|
|
=== Code examples
|
|
|
|
==== Noncompliant code example
|
|
|
|
[source,xml,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
<filter>
|
|
<filter-name>ValidationFilter</filter-name> <!-- Noncompliant -->
|
|
<filter-class>com.myco.servlet.ValidationFilter</filter-class>
|
|
</filter>
|
|
----
|
|
|
|
==== Compliant solution
|
|
|
|
[source,xml,diff-id=1,diff-type=compliant]
|
|
----
|
|
<filter>
|
|
<filter-name>ValidationFilter</filter-name>
|
|
<filter-class>com.myco.servlet.ValidationFilter</filter-class>
|
|
</filter>
|
|
|
|
<filter-mapping>
|
|
<filter-name>ValidationFilter</filter-name>
|
|
<url-pattern>/*</url-pattern>
|
|
</filter-mapping>
|
|
----
|
|
|
|
== Resources
|
|
|
|
=== Documentation
|
|
|
|
* Struts Docs - https://struts.apache.org/core-developers/web-xml[Web.xml Developpers Guide]
|
|
|
|
=== Standards
|
|
|
|
* OWASP - https://owasp.org/Top10/A05_2021-Security_Misconfiguration/[Top 10 2021 Category A5 - Security Misconfiguration]
|
|
* OWASP - https://owasp.org/www-project-top-ten/2017/A6_2017-Security_Misconfiguration[Top 10 2017 Category A6 - Security Misconfiguration]
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
=== Message
|
|
|
|
* "xxx" filter should have a mapping.
|
|
|
|
'''
|
|
|
|
endif::env-github,rspecator-view[]
|