search

SpineEventEngine / validation

Apache License 2.0
2 stars 0 forks source link

Evaluate Tainting Checker from Checker Framework #16

Open alexander-yevsyukov opened 2 years ago

alexander-yevsyukov commented 2 years ago

https://checkerframework.org/manual/#tainting-checker

What the Checker Framework offers is closely related to Validation, but on a deeper level of security. It's an interesting and useful feature we need to consider.

alexander-yevsyukov commented 2 years ago

In 2021.3 version IDEA provided the inspection which handles tainted annotations:

IntelliJ IDEA has added a new inspection “Non-safe string passed to a safe method”, which helps avoid passing insecure data to secure methods in projects that use the org.checkerframework.checker.tainting.qual annotations. Problems that could be detected by this inspection include SQL injections and XSS flaws.