Update HomeController.java #45
Conversation
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/webapp/WEB-INF/views/profile.jsp: Fix suggestions: --- test/src/main/webapp/WEB-INF/views/profile.jsp
+++ test/src/main/webapp/WEB-INF/views/profile.jsp
@@ -157,10 +157,10 @@
<li>
<div class="clear">
<div class="commenterImage">
- <img src="resources/images/<%= heckler.getUsername() %>.png" />
+ <img src="resources/images/<%= heckler.getUsername() %>.png" /><%= Encode.forHtml(heckler.getUsername()) %> <img src="resources/images/<%= heckler.getUsername() %>.png" />
</div>
<div class="commentText">
- <p><%= heckler.getBlabName() %></p>
+ <p><%= heckler.getBlabName() %></p><%= ESAPI.encoder().encodeForHTMLAttribute(heckler.getBlabName()) %> <p><%= heckler.getBlabName() %></p>
<span class="date sub-text">member since <%= heckler.getCreatedDateString() %></span>
<br/>
</div>
@@ -237,14 +237,14 @@
data : new FormData(this),
processData : false,
contentType : false,
- success : function(data) {
+ success : function(data) {e.preventDefault() success : function(data) {
console.log("Profile updated");
if (data) {
if ('values' in data) {
$.each(data.values, function(key, val) {
$('input[name="' + key + '"]').val(val);
if (key === "username") {
- $('#profileImage').attr('src', 'resources/images/' + val + '.png');
+ $('#profileImage').attr('src', 'resources/images/' + val + '.png');val = ESAPI.encoder().encodeForHTMLAttribute(val) $('#profileImage').attr('src', 'resources/images/' + val + '.png');
}
});
}
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/webapp/WEB-INF/views/blab.jsp: Fix suggestions: --- test/src/main/webapp/WEB-INF/views/blab.jsp
+++ test/src/main/webapp/WEB-INF/views/blab.jsp
@@ -101,13 +101,13 @@
<li>
<div>
<div class="commenterImage">
- <img src="resources/images/<%= comment.getAuthor().getUsername() %>.png" />
+ <img src="resources/images/<%= comment.getAuthor().getUsername() %>.png" />HtmlUtils.htmlEscape(comment.getAuthor().()) <img src="resources/images/<%= comment.getAuthor().getUsername() %>.png" />
</div>
<div class="blockquote">
<p class="">
- "<%= comment.getContent() %>"
+ "<%= comment.getContent() %>", produces="application/json" "<%= comment.getContent() %>"
</p>
- <span class="date sub-text">by <%= comment.getAuthor().getBlabName() %>
+ <span class="date sub-text">by <%= comment.getAuthor().getBlabName() %>(ESAPI.encoder().encodeForHTMLAttribute(comment.getAuthor().getBlabName())) <span class="date sub-text">by <%= comment.getAuthor().getBlabName() %>
on <%= comment.getTimestampString() %></span><br>
</div>
</div>
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/java/com/veracode/verademo/controller/BlabController.java: Fix suggestions: --- test/src/main/java/com/veracode/verademo/controller/BlabController.java
+++ test/src/main/java/com/veracode/verademo/controller/BlabController.java
@@ -28,6 +28,10 @@
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.ResponseBody;
+import org.apache.commons.text.StringEscapeUtils;
+import org.apache.commons.lang3.StringUtils;
+import java.net.URLEncoder;
+import org.owasp.encoder.Encode;
@Controller
@Scope("request")
@@ -57,7 +61,7 @@
return Utils.redirect("login?target=profile");
}
- logger.info("User is Logged In - continuing... UA=" + httpRequest.getHeader("User-Agent") + " U=" + username);
+ logger.info("User is Logged In - continuing... UA=" + URLEncoder.encode(httpRequest.getHeader("User-Agent").toString()) + " U=" + username);
Connection connect = null;
PreparedStatement blabsByMe = null;
@@ -193,7 +197,7 @@
logger.error(ex);
}
- return ret.toString();
+ return Encode.forHtml(ret.toString());
}
@RequestMapping(value = "/feed", method = RequestMethod.POST)
@@ -210,7 +214,7 @@
logger.info("User is not Logged In - redirecting...");
return Utils.redirect("login?target=profile");
}
- logger.info("User is Logged In - continuing... UA=" + httpRequest.getHeader("User-Agent") + " U=" + username);
+ logger.info("User is Logged In - continuing... UA=" + StringEscapeUtils.escapeJava(httpRequest.getHeader("User-Agent")) + " U=" + username);
Connection connect = null;
PreparedStatement addBlab = null;
@@ -275,7 +279,7 @@
return Utils.redirect("login?target=profile");
}
- logger.info("User is Logged In - continuing... UA=" + httpRequest.getHeader("User-Agent") + " U=" + username);
+ logger.info("User is Logged In - continuing... UA=" + StringEscapeUtils.escapeJava(httpRequest.getHeader("User-Agent")) + " U=" + username);
Connection connect = null;
PreparedStatement blabDetails = null;
@@ -370,7 +374,7 @@
return Utils.redirect("login?target=feed");
}
- logger.info("User is Logged In - continuing... UA=" + httpRequest.getHeader("User-Agent") + " U=" + username);
+ logger.info("User is Logged In - continuing... UA=" + URLEncoder.encode(httpRequest.getHeader("User-Agent")) + " U=" + username);
Connection connect = null;
PreparedStatement addComment = null;
String addCommentSql = "INSERT INTO comments (blabid, blabber, content, timestamp) values (?, ?, ?, ?);";
@@ -441,30 +445,28 @@
return Utils.redirect("login?target=blabbers");
}
- logger.info("User is Logged In - continuing... UA=" + httpRequest.getHeader("User-Agent") + " U=" + username);
+ logger.info("User is Logged In - continuing... UA=" + URLEncoder.encode(httpRequest.getHeader("User-Agent")) + " U=" + username);
Connection connect = null;
PreparedStatement blabberQuery = null;
-
- /* START EXAMPLE VULNERABILITY */
- String blabbersSql = "SELECT users.username," + " users.blab_name," + " users.created_at,"
- + " SUM(if(listeners.listener=?, 1, 0)) as listeners,"
- + " SUM(if(listeners.status='Active',1,0)) as listening"
- + " FROM users LEFT JOIN listeners ON users.username = listeners.blabber"
- + " WHERE users.username NOT IN (\"admin\",?)" + " GROUP BY users.username" + " ORDER BY " + sort + ";";
-
+ /* START EXAMPLE FIX */
+ String blabbersSql = "SELECT users.username, " + " users.blab_name, " + " users.created_at, "
+ + " SUM(if(listeners.listener=?, 1, 0)) as listeners, "
+ + " SUM(if(listeners.status='Active', 1, 0)) as listening"
+ + " FROM users LEFT JOIN listeners ON users.username = listeners.blabber"
+ + " WHERE users.username NOT IN (?)" + " GROUP BY users.username" + " ORDER BY " + sort + ";";
try {
- logger.info("Getting Database connection");
- // Get the Database Connection
- Class.forName("com.mysql.jdbc.Driver");
- connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());
-
- // Find the Blabbers
- logger.info(blabbersSql);
- blabberQuery = connect.prepareStatement(blabbersSql);
- blabberQuery.setString(1, username);
- blabberQuery.setString(2, username);
- ResultSet blabbersResults = blabberQuery.executeQuery();
+ logger.info("Getting Database connection");
+ // Get the Database Connection
+ Class.forName("com.mysql.jdbc.Driver");
+ connect = DriverManager.getConnection(Constants.create().getJdbcConnectionString());
+ // Find the Blabbers
+ logger.info(blabbersSql);
+ blabberQuery = connect.prepareStatement(blabbersSql);
+ blabberQuery.setString(1, username);
+ blabberQuery.setString(2, username);
+ blabberQuery.setString(3, username);
+ ResultSet blabbersResults = blabberQuery.executeQuery();
/* END EXAMPLE VULNERABILITY */
List<Blabber> blabbers = new ArrayList<Blabber>();
@@ -520,15 +522,15 @@
return Utils.redirect("login?target=blabbers");
}
- logger.info("User is Logged In - continuing... UA=" + httpRequest.getHeader("User-Agent") + " U=" + username);
+ logger.info("User is Logged In - continuing... UA=" + URLEncoder.encode(httpRequest.getHeader("User-Agent")) + " U=" + username);
if (command == null || command.isEmpty()) {
logger.info("Empty command provided...");
return nextView = Utils.redirect("login?target=blabbers");
}
- logger.info("blabberUsername = " + blabberUsername);
- logger.info("command = " + command);
+ logger.info("blabberUsername = " + StringUtils.normalizeSpace(blabberUsername));
+ logger.info("command = " + StringUtils.normalizeSpace(command));
Connection connect = null;
PreparedStatement action = null;
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/java/com/veracode/verademo/controller/UserController.java: Fix suggestions: --- test/src/main/java/com/veracode/verademo/controller/UserController.java
+++ test/src/main/java/com/veracode/verademo/controller/UserController.java
@@ -11,6 +11,7 @@
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
+import org.apache.commons.text.StringEscapeUtils;
/**
* @author johnadmin
@@ -44,7 +45,7 @@
}
//..
- logger.info("Entering showLogin with username " + username + " and target " + target);
+ logger.info("Entering showLogin with username " + StringEscapeUtils.escapeJava(username) + " and target " + target);
model.addAttribute("username", username);
model.addAttribute("target", target);
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/webapp/WEB-INF/views/feed.jsp: Fix suggestions: --- test/src/main/webapp/WEB-INF/views/feed.jsp
+++ test/src/main/webapp/WEB-INF/views/feed.jsp
@@ -90,12 +90,12 @@
<li>
<div>
<div class="commenterImage">
- <img src="resources/images/<%= post.getAuthor().getUsername() %>.png" />
+ <img src="resources/images/<%= post.getAuthor().getUsername() %>.png" /><%= StringEscapeUtils.escapeXml11(post.getAuthor().getUsername()) %> <img src="resources/images/<%= post.getAuthor().getUsername() %>.png" />
</div>
<div class="commentText">
- <p class=""><%= post.getContent() %></p>
+ <p class=""><%= post.getContent() %></p>ESAPI.encoder().encodeForHTMLAttribute(post.getContent()) <p class=""><%= post.getContent() %></p>
<span class="date sub-text">
- by <%= post.getAuthor().getBlabName() %> on <%= post.getPostDateString() %>
+ by <%= post.getAuthor().getBlabName() %> on <%= post.getPostDateString() %>by <%= ESAPI.encoder().encodeForHTMLAttribute(post.getAuthor().getBlabName()) %> by <%= post.getAuthor().getBlabName() %> on <%= post.getPostDateString() %>
</span>
<br/>
<span class="date sub-text">
@@ -138,7 +138,7 @@
%>
<li>
<div class="commentText">
- <p class=""><%= post.getContent() %></p>
+ <p class=""><%= post.getContent() %></p><%= StringEscapeUtils.escapeXml11(post.getContent()) %> <p class=""><%= post.getContent() %></p>
<span class="date sub-text">by you on <%= post.getPostDateString() %></span><br/>
<span class="date sub-text">
<a href="blab?blabid=<%= post.getId() %>"><%= post.getCommentCount() %> Comments</a>
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/java/com/veracode/verademo/commands/IgnoreCommand.java: Fix suggestions: --- test/src/main/java/com/veracode/verademo/commands/IgnoreCommand.java
+++ test/src/main/java/com/veracode/verademo/commands/IgnoreCommand.java
@@ -8,6 +8,8 @@
import org.apache.log4j.LogManager;
import org.apache.log4j.Logger;
+import org.apache.commons.lang3.StringUtils;
+import java.net.URLEncoder;
//..
public class IgnoreCommand implements BlabberCommand {
private static final Logger logger = LogManager.getLogger("VeraDemo:IgnoreCommand");
@@ -24,7 +26,7 @@
@Override
public void execute(String blabberUsername) {
- String sqlQuery = "DELETE FROM listeners WHERE blabber=? AND listener=?;";
+ String sqlQuery = StringUtils.normalizeSpace("DELETE FROM listeners WHERE blabber=? AND listener=?;");
logger.info(sqlQuery);
PreparedStatement action;
try {
@@ -41,10 +43,13 @@
result.next();
/* START EXAMPLE VULNERABILITY */
- String event = username + " is now ignoring " + blabberUsername + " (" + result.getString(1) + ")";
- sqlQuery = "INSERT INTO users_history (blabber, event) VALUES (\"" + username + "\", \"" + event + "\")";
+ String event = username + " is now ignoring " + blabberUsername + " (" + URLEncoder.encode(result.getString(1).toString()) + ")";
+ sqlQuery = "INSERT INTO users_history (blabber, event) VALUES (?,?)";
logger.info(sqlQuery);
- sqlStatement.execute(sqlQuery);
+ sqlStatement = connect.prepareStatement(sqlQuery);
+ sqlStatement.setString(1, username);
+ sqlStatement.setString(2, event);
+ sqlStatement.execute();
/* END EXAMPLE VULNERABILITY */
} catch (SQLException e) {
// TODO Auto-generated catch block
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/java/com/veracode/verademo/commands/ListenCommand.java: Fix suggestions: --- test/src/main/java/com/veracode/verademo/commands/ListenCommand.java
+++ test/src/main/java/com/veracode/verademo/commands/ListenCommand.java
@@ -8,6 +8,8 @@
import org.apache.log4j.LogManager;
import org.apache.log4j.Logger;
+import java.net.URLEncoder;
+import org.apache.commons.lang3.StringUtils;
public class ListenCommand implements BlabberCommand {
private static final Logger logger = LogManager.getLogger("VeraDemo:ListenCommand");
@@ -24,7 +26,7 @@
@Override
public void execute(String blabberUsername) {
- String sqlQuery = "INSERT INTO listeners (blabber, listener, status) values (?, ?, 'Active');";
+ String sqlQuery = StringUtils.normalizeSpace("INSERT INTO listeners (blabber, listener, status) values (?, ?, 'Active');");
logger.info(sqlQuery);
PreparedStatement action;
try {
@@ -41,10 +43,13 @@
result.next();
/* START EXAMPLE VULNERABILITY */
- String event = username + " started listening to " + blabberUsername + " (" + result.getString(1) + ")";
+ String event = username + " started listening to " + blabberUsername + " (" + URLEncoder.encode(result.getString(1).toString()) + ")";
sqlQuery = "INSERT INTO users_history (blabber, event) VALUES (\"" + username + "\", \"" + event + "\")";
logger.info(sqlQuery);
- sqlStatement.execute(sqlQuery);
+ PreparedStatement sqlStatement = connect.prepareStatement(sqlQuery);
+ sqlStatement.setString(1, username);
+ sqlStatement.setString(2, event);
+ sqlStatement.execute();
/* END EXAMPLE VULNERABILITY */
} catch (SQLException e) {
// TODO Auto-generated catch block
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/java/com/veracode/verademo/commands/RemoveAccountCommand.java: Fix suggestions: --- test/src/main/java/com/veracode/verademo/commands/RemoveAccountCommand.java
+++ test/src/main/java/com/veracode/verademo/commands/RemoveAccountCommand.java
@@ -8,6 +8,9 @@
import org.apache.log4j.LogManager;
import org.apache.log4j.Logger;
+import org.apache.commons.lang3.StringUtils;
+import java.net.URLEncoder;
+import java.util.*;
public class RemoveAccountCommand implements BlabberCommand {
private static final Logger logger = LogManager.getLogger("VeraDemo:RemoveAccountCommand");
@@ -26,7 +29,7 @@
*/
@Override
public void execute(String blabberUsername) {
- String sqlQuery = "DELETE FROM listeners WHERE blabber=? OR listener=?;";
+ String sqlQuery = StringUtils.normalizeSpace("DELETE FROM listeners WHERE blabber=? OR listener=?;");
logger.info(sqlQuery);
PreparedStatement action;
try {
@@ -43,14 +46,18 @@
result.next();
/* START EXAMPLE VULNERABILITY */
- String event = "Removed account for blabber " + result.getString(1);
+ Set<String> whitelistResultGetstring1 = new HashSet<>(Arrays.asList("item1", "item2", "item3"));
+ if (!result.getString(1).matches("\\w+(\\s*\\.\\s*\\w+)*") && !whitelistResultGetstring1.contains(result.getString(1)))
+ throw new IllegalArgumentException();
+ String event = "Removed account for blabber " + URLEncoder.encode(result.getString(1).toString());
sqlQuery = "INSERT INTO users_history (blabber, event) VALUES ('" + blabberUsername + "', '" + event + "')";
logger.info(sqlQuery);
sqlStatement.execute(sqlQuery);
sqlQuery = "DELETE FROM users WHERE username = '" + blabberUsername + "'";
logger.info(sqlQuery);
- sqlStatement.execute(sqlQuery);
+ PreparedStatement sqlStatement2 = conn.prepareStatement(sqlQuery);
+ sqlStatement2.execute();
/* END EXAMPLE VULNERABILITY */
} catch (SQLException e) {
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/webapp/WEB-INF/views/tools.jsp: Fix suggestions: --- test/src/main/webapp/WEB-INF/views/tools.jsp
+++ test/src/main/webapp/WEB-INF/views/tools.jsp
@@ -61,7 +61,7 @@
<form method="post">
<label for="host">Host:</label> <input type="text" name="host"
<%if (request.getParameter("host") != null) {%>
- value="<%=request.getParameter("host")%>" <%}%> /> <input
+ value="<%=request.getParameter("host")%>" <%}%> /> <inputvalue="<%=ESAPI.encoder().encodeForHTMLAttribute(request.getParameter("host"))%> value="<%=request.getParameter("host")%>" <%}%> /> <input
type="submit" value="Check" />
</form>
<pre>${ping}</pre>
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/webapp/WEB-INF/views/blabbers.jsp: Fix suggestions: --- test/src/main/webapp/WEB-INF/views/blabbers.jsp
+++ test/src/main/webapp/WEB-INF/views/blabbers.jsp
@@ -97,10 +97,10 @@
%>
<tr>
<td class="commenterImage">
- <img src="resources/images/<%= blabber.getUsername() %>.png" />
+ <img src="resources/images/<%= blabber.getUsername() %>.png" /><%= ESAPI.encoder().encodeForHTMLAttribute(blabber.getBlabName()) %> <img src="resources/images/<%= blabber.getUsername() %>.png" />
</td>
<td class="commenterName">
- <%= blabber.getBlabName() %>
+ <%= blabber.getBlabName() %><%= ESAPI.encoder().encodeForHTMLAttribute(blabber.getBlabName()) %> <%= blabber.getBlabName() %>
</td>
<td class="commenterJoinDate">
<%= blabber.getCreatedDateString() %>
|
|
Caution Breaking Flaws identified in code! Fixes for test/src/main/java/com/veracode/verademo/controller/ToolsController.java: Fix suggestions: --- test/src/main/java/com/veracode/verademo/controller/ToolsController.java
+++ test/src/main/java/com/veracode/verademo/controller/ToolsController.java
@@ -16,6 +16,7 @@
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestMethod;
import org.springframework.web.bind.annotation.RequestParam;
+import org.apache.commons.lang3.StringUtils;
@Controller
@Scope("request")
@@ -46,7 +47,7 @@
String output = "";
Process proc;
- logger.info("Pinging: " + host);
+ logger.info("Pinging: " + StringUtils.normalizeSpace(host));
try {
/* START EXAMPLE VULNERABILITY */
|
No description provided.