Skip to content

Commit 736a79f

Browse files
righettodinkz
righettod
and
inkz
authored
[REPLACE] New Published Rules - righettod.security-constraint-http-method. (#3650)
* Add files via upload * Update security-constraint-http-method.yaml --------- Co-authored-by: Vasilii Ermilov <[email protected]>
1 parent fa380ee commit 736a79f

File tree

2 files changed

+155
-0
lines changed

2 files changed

+155
-0
lines changed

‎java/servlets/security/security-constraint-http-method.xml‎

Lines changed: 124 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,124 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
5+
version="4.0">
6+
7+
<display-name>My Secure Web Application</display-name>
8+
9+
<servlet>
10+
<servlet-name>HomeServlet</servlet-name>
11+
<servlet-class>com.example.servlet.HomeServlet</servlet-class>
12+
<init-param>
13+
<param-name>welcomeMessage</param-name>
14+
<param-value>Welcome to our application!</param-value>
15+
</init-param>
16+
<load-on-startup>1</load-on-startup>
17+
</servlet>
18+
19+
<servlet>
20+
<servlet-name>ProductServlet</servlet-name>
21+
<servlet-class>com.example.servlet.ProductServlet</servlet-class>
22+
<init-param>
23+
<param-name>productServiceUrl</param-name>
24+
<param-value>http://api.example.com/products</param-value>
25+
</init-param>
26+
</servlet>
27+
28+
<servlet-mapping>
29+
<servlet-name>HomeServlet</servlet-name>
30+
<url-pattern>/home</url-pattern>
31+
<url-pattern>/</url-pattern> </servlet-mapping>
32+
33+
<servlet-mapping>
34+
<servlet-name>ProductServlet</servlet-name>
35+
<url-pattern>/products/*</url-pattern> </servlet-mapping>
36+
37+
<filter>
38+
<filter-name>LoggingFilter</filter-name>
39+
<filter-class>com.example.filter.LoggingFilter</filter-class>
40+
<init-param>
41+
<param-name>logLevel</param-name>
42+
<param-value>INFO</param-value>
43+
</init-param>
44+
</filter>
45+
46+
<filter>
47+
<filter-name>AuthenticationFilter</filter-name>
48+
<filter-class>com.example.filter.AuthenticationFilter</filter-class>
49+
</filter>
50+
51+
<filter-mapping>
52+
<filter-name>LoggingFilter</filter-name>
53+
<url-pattern>/*</url-pattern>
54+
<dispatcher>REQUEST</dispatcher>
55+
<dispatcher>FORWARD</dispatcher>
56+
</filter-mapping>
57+
58+
<filter-mapping>
59+
<filter-name>AuthenticationFilter</filter-name>
60+
<servlet-name>ProductServlet</servlet-name>
61+
<dispatcher>REQUEST</dispatcher>
62+
</filter-mapping>
63+
64+
65+
<security-constraint>
66+
<display-name>Admin Area Constraint</display-name>
67+
<web-resource-collection>
68+
<web-resource-name>Admin Pages</web-resource-name>
69+
<url-pattern>/admin/*</url-pattern>
70+
<!-- ruleid: security-constraint-http-method -->
71+
<http-method>GET</http-method>
72+
<!-- ruleid: security-constraint-http-method -->
73+
<http-method>POST</http-method>
74+
</web-resource-collection>
75+
<auth-constraint>
76+
<role-name>admin</role-name>
77+
</auth-constraint>
78+
</security-constraint>
79+
80+
<security-constraint>
81+
<display-name>Secure Connection Constraint</display-name>
82+
<web-resource-collection>
83+
<web-resource-name>HTTPS Required Pages</web-resource-name>
84+
<url-pattern>/secure/*</url-pattern>
85+
</web-resource-collection>
86+
<user-data-constraint>
87+
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
88+
</user-data-constraint>
89+
</security-constraint>
90+
91+
<login-config>
92+
<auth-method>FORM</auth-method>
93+
<realm-name>MyWebAppRealm</realm-name>
94+
<form-login-config>
95+
<form-login-page>/login.jsp</form-login-page>
96+
<form-error-page>/login-error.jsp</form-error-page>
97+
</form-login-config>
98+
</login-config>
99+
100+
<security-role>
101+
<description>Administrator Role</description>
102+
<role-name>admin</role-name>
103+
</security-role>
104+
<security-role>
105+
<description>User Role</description>
106+
<role-name>user</role-name>
107+
</security-role>
108+
109+
<welcome-file-list>
110+
<welcome-file>index.html</welcome-file>
111+
<welcome-file>index.jsp</welcome-file>
112+
<welcome-file>default.html</welcome-file>
113+
</welcome-file-list>
114+
115+
<error-page>
116+
<error-code>404</error-code>
117+
<location>/errors/404.html</location>
118+
</error-page>
119+
<error-page>
120+
<exception-type>java.lang.Throwable</exception-type>
121+
<location>/errors/general-error.html</location>
122+
</error-page>
123+
124+
</web-app>

‎java/servlets/security/security-constraint-http-method.yaml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
rules:
2+
- id: security-constraint-http-method
3+
languages:
4+
- xml
5+
severity: WARNING
6+
message: >-
7+
The tag "http-method" is used to specify on which HTTP methods the java web security constraint apply.
8+
The target security constraints could be bypassed if a non listed HTTP method is used.
9+
Inverse the logic by using the tag "http-method-omission" to define for which HTTP methods the security constraint do not apply.
10+
Using this way, only expected allowed HTTP methods will be skipped by the security constraint.
11+
pattern: <http-method>$X</http-method>
12+
paths:
13+
include:
14+
- "**/web.xml"
15+
metadata:
16+
category: security
17+
owasp:
18+
- A05:2021 Security Misconfiguration
19+
- A01:2021 Broken Access Control
20+
technology:
21+
- java
22+
references:
23+
- https://docs.oracle.com/javaee/7/tutorial/security-webtier002.htm
24+
- https://jakarta.ee/learn/docs/jakartaee-tutorial/current/security/security-advanced/security-advanced.html#_securing_http_resources
25+
cwe:
26+
- "CWE-863: Incorrect Authorization"
27+
likelihood: LOW
28+
impact: LOW
29+
confidence: LOW
30+
subcategory:
31+
- audit

0 commit comments

Comments
 (0)