Insecure Use of Language/Framework API
This category covers the following issues:
Why is this important?
Java, like any other programming language, has powerful or security related APIs. If these APIs are not used properly, it can have a catastrophic impact on your app.
Cross Site Request Forgery
Check out this video for a high-level explanation of CSRF:
Read below to find out how to fix this issue in your code.
Fixing Cross Site Request Forgery (CSRF)
The following issues are detected by GuardRails:
Disabled CSRF
Disabling Spring Security's CSRF protection is unsafe for standard web applications. A valid use case for disabling this protection would be a service exposing state-changing operations that is guaranteed to be used only by non-browser clients.
Unrestricted Spring RequestMapping
Methods annotated with RequestMapping are by default mapped to all the HTTP
request methods. However, Spring Security's CSRF protection is not enabled by
default for the HTTP request methods GET, HEAD, TRACE, and OPTIONS
(as this could cause the tokens to be leaked). Therefore, state-changing
methods annotated with RequestMapping and not narrowing the mapping
to the HTTP request methods POST, PUT, DELETE, or PATCH are vulnerable
to CSRF attacks.
Option A: Configure CSRF securely
- Go through the issues that GuardRails identified in the PR.
- Identify the following patterns:
//Disabled CSRF
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.csrf().disable();
}
}
or:
@Controller
public class UnsafeController {
@RequestMapping("/path")
public void writeData() {
// State-changing operations performed within this method.
}
}
- Otherwise, use the following pattern instead:
@Controller
public class SafeController {
/**
* For methods without side-effects use @GetMapping.
*/
@GetMapping("/path")
public String readData() {
// No state-changing operations performed within this method.
return "";
}
/**
* For state-changing methods use either @PostMapping, @PutMapping, @DeleteMapping, or @PatchMapping.
*/
@PostMapping("/path")
public void writeData() {
// State-changing operations performed within this method.
}
}
- Test it and ensure the functionality works as expected
- Ship it 🚢 and relax 🌴