github-actions[bot]
commented
3 months ago undefined
[!CAUTION] Breaking Flaws identified in code!
Fixes for src/main/java/com/veracode/verademo/controller/UserController.java: Falws found for this file: CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 231 for issue 1136 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 495 for issue 1141 CWE 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - Severity 4 on line 253 for issue 1016 CWE 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - Severity 4 on line 508 for issue 1025 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 710 for issue 1135 CWE 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - Severity 4 on line 497 for issue 1017 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 114 for issue 1139 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 239 for issue 1155 CWE 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - Severity 4 on line 386 for issue 1010 CWE 89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - Severity 4 on line 318 for issue 1015 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 660 for issue 1137 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 805 for issue 1143 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 257 for issue 1140 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 696 for issue 1148 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 387 for issue 1138 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 251 for issue 1149 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 506 for issue 1150 CWE 117 - Improper Output Neutralization for Logs - Severity 3 on line 861 for issue 1142
Fix suggestions:
--- src/main/java/com/veracode/verademo/controller/UserController.java
+++ src/main/java/com/veracode/verademo/controller/UserController.java
@@ -50,6 +50,10 @@
import com.veracode.verademo.utils.Constants;
import com.veracode.verademo.utils.User;
import com.veracode.verademo.utils.UserFactory;
+import org.apache.commons.lang3.StringUtils;
+import java.util.*;
+import org.apache.commons.text.StringEscapeUtils;
+import java.net.URLEncoder;
/**
* @author johnadmin
@@ -111,7 +115,7 @@
target = "";
}
- logger.info("Entering showLogin with username " + username + " and target " + target);
+ logger.info("Entering showLogin with username " + StringEscapeUtils.escapeJava(username) + " and target " + target);
model.addAttribute("username", username);
model.addAttribute("target", target);
@@ -228,7 +232,7 @@
}
// Redirect to the appropriate place based on login actions above
- logger.info("Redirecting to view: " + nextView);
+ logger.info("Redirecting to view: " + StringUtils.normalizeSpace(nextView));
return nextView;
}
@@ -236,7 +240,7 @@
@ResponseBody
public String showPasswordHint(String username)
{
- logger.info("Entering password-hint with username: " + username);
+ logger.info("Entering password-hint with username: " + StringUtils.normalizeSpace(username));
if (username == null || username.isEmpty()) {
return "No username provided, please type in your username first";
@@ -249,8 +253,13 @@
String sql = "SELECT password_hint FROM users WHERE username = '" + username + "'";
logger.info(sql);
+ Set<String> whitelistUsername = new HashSet<>(Arrays.asList("item1", "item2", "item3"));
+ if (!username.matches("\\w+(\\s*\\.\\s*\\w+)*") && !whitelistUsername.contains(username))
+ throw new IllegalArgumentException();
+
Statement statement = connect.createStatement();
ResultSet result = statement.executeQuery(sql);
+
if (result.first()) {
String password= result.getString("password_hint");
String formatString = "Username '" + username + "' has password: %.2s%s";
@@ -361,7 +370,7 @@
}
Connection connect = null;
- Statement sqlStatement = null;
+ PreparedStatement sqlStatement = null;
try {
// Get the Database Connection
@@ -382,9 +391,16 @@
query.append("'" + blabName + "'");
query.append(");");
- sqlStatement = connect.createStatement();
- sqlStatement.execute(query.toString());
- logger.info(query.toString());
+
+ Set<String> whitelistBlabname = new HashSet<>(Arrays.asList("item1", "item2", "item3"));
+ if (!blabName.matches("\\w+(\\s*\\.\\s*\\w+)*") && !whitelistBlabname.contains(blabName))
+ throw new IllegalArgumentException();
+
+ sqlStatement = connect.prepareStatement(query.toString());
+
+ sqlStatement.execute();
+
+ logger.info(URLEncoder.encode(query.toString()));
/* END BAD CODE */
emailUser(username);
@@ -453,7 +469,7 @@
{
logger.info("Entering showProfile");
- String username = (String) httpRequest.getSession().getAttribute("username");
+ String username = (String) StringUtils.normalizeSpace(httpRequest.getSession().getAttribute("username"));
// Ensure user is logged in
if (username == null) {
logger.info("User is not Logged In - redirecting...");
@@ -502,10 +518,13 @@
}
// Get the users information
- String sql = "SELECT username, real_name, blab_name FROM users WHERE username = '" + username + "'";
+ String sql = "SELECT username, real_name, blab_name FROM users WHERE username = ?";
logger.info(sql);
myInfo = connect.prepareStatement(sql);
+ myInfo.setString(1, username);
+
ResultSet myInfoResults = myInfo.executeQuery();
+
myInfoResults.next();
// Send these values to our View
@@ -657,7 +676,7 @@
String extension = file.getOriginalFilename().substring(file.getOriginalFilename().lastIndexOf("."));
String path = imageDir + username + extension;
- logger.info("Saving new profile image: " + path);
+ logger.info("Saving new profile image: " + StringEscapeUtils.escapeJava(path));
file.transferTo(new File(path)); // will delete any existing file first
}
@@ -693,7 +712,7 @@
String path = context.getRealPath("/resources/images") + File.separator + imageName;
- logger.info("Fetching profile image: " + path);
+ logger.info("Fetching profile image: " + StringUtils.normalizeSpace(path));
InputStream inputStream = null;
OutputStream outStream = null;
@@ -707,7 +726,7 @@
// set to binary type if MIME mapping not found
mimeType = "application/octet-stream";
}
- logger.info("MIME type: " + mimeType);
+ logger.info("MIME type: " + StringUtils.normalizeSpace(mimeType));
// Set content attributes for the response
response.setContentType(mimeType);
@@ -802,7 +821,7 @@
}
}
- logger.info("Username: " + username + " already exists. Try again.");
+ logger.info("Username: " + StringEscapeUtils.escapeJava(username) + " already exists. Try again.");
return true;
}
@@ -858,7 +877,7 @@
if (oldImage != null) {
String extension = oldImage.substring(oldImage.lastIndexOf("."));
- logger.info("Renaming profile image from " + oldImage + " to " + newUsername + extension);
+ logger.info("Renaming profile image from " + oldImage + " to " + StringUtils.normalizeSpace(newUsername) + extension);
String path = context.getRealPath("/resources/images") + File.separator;
File oldName = new File(path + oldImage);
Scan Summary:
PIPELINE_SCAN_VERSION: 24.5.0-0
DEV-STAGE: DEVELOPMENT
SCAN_ID: b7b2ad69-5715-4bac-819a-49dbbd330022
SCAN_STATUS: SUCCESS
SCAN_MESSAGE: Scan successful. Results size: 938071 bytes
====================
Analysis Successful.
====================
==========================
Found 2 Scannable modules.
==========================
verademo.war
JS files within verademo.war
===================
Analyzed 2 modules.
===================
verademo.war
JS files within verademo.war
====================
Analyzed 184 issues.
====================
details
-------------------------------------
Found 5 issues of Very High severity.
-------------------------------------
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'): WEB-INF/views/login.jsp:33
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): com/veracode/verademo/controller/ToolsController.java:56
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): com/veracode/verademo/controller/ToolsController.java:59
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): com/veracode/verademo/controller/ToolsController.java:91
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'): com/veracode/verademo/controller/ToolsController.java:94
---------------------------------
Found 13 issues of High severity.
---------------------------------
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/controller/UserController.java:253
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/controller/UserController.java:318
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/controller/UserController.java:386
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/controller/UserController.java:497
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/controller/UserController.java:508
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/controller/BlabController.java:490
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/commands/RemoveAccountCommand.java:40
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/commands/RemoveAccountCommand.java:47
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/commands/RemoveAccountCommand.java:51
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/commands/ListenCommand.java:40
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/commands/ListenCommand.java:47
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/commands/IgnoreCommand.java:40
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): com/veracode/verademo/commands/IgnoreCommand.java:47
---------------------------------------
Skipping 119 issues of Medium severity.
---------------------------------------
-----------------------------------
Skipping 30 issues of Low severity.
-----------------------------------
---------------------------------------------
Skipping 17 issues of Informational severity.
---------------------------------------------
=========================
FAILURE: Found 18 issues!
=========================