Skip to main content

Insecure Use of Language/Framework API

This category covers the following issues:

Why is this important?

Java, like any other programming language, has powerful or security related APIs. If these APIs are not used properly, it can have a catastrophic impact on your app.

Cross Site Request Forgery

Check out this video for a high-level explanation of CSRF:

OS Command Injection

Read below to find out how to fix this issue in your code.

Fixing Cross Site Request Forgery (CSRF)

The following issues are detected by GuardRails:

Disabled CSRF

Disabling Spring Security's CSRF protection is unsafe for standard web applications. A valid use case for disabling this protection would be a service exposing state-changing operations that is guaranteed to be used only by non-browser clients.

Unrestricted Spring RequestMapping

Methods annotated with RequestMapping are by default mapped to all the HTTP request methods. However, Spring Security's CSRF protection is not enabled by default for the HTTP request methods GET, HEAD, TRACE, and OPTIONS (as this could cause the tokens to be leaked). Therefore, state-changing methods annotated with RequestMapping and not narrowing the mapping to the HTTP request methods POST, PUT, DELETE, or PATCH are vulnerable to CSRF attacks.

Option A: Configure CSRF securely

  1. Go through the issues that GuardRails identified in the PR

  2. Identify the following patterns:

    //Disabled CSRF
    @EnableWebSecurity
    public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
    http.csrf().disable();
    }
    }

    or:

    @Controller
    public class UnsafeController {
    @RequestMapping("/path")
    public void writeData() {
    // State-changing operations performed within this method.
    }
    }
  3. Otherwise, use the following pattern instead:

    @Controller
    public class SafeController {
    /**
    * For methods without side-effects use @GetMapping.
    */
    @GetMapping("/path")
    public String readData() {
    // No state-changing operations performed within this method.
    return "";
    }
    /**
    * For state-changing methods use either @PostMapping, @PutMapping, @DeleteMapping, or @PatchMapping.
    */
    @PostMapping("/path")
    public void writeData() {
    // State-changing operations performed within this method.
    }
    }
  4. Test it and ensure the functionality works as expected

  5. Ship it 🚢 and relax 🌴

More information