Test2 #3
Test2 #3
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| ProcessBuilder pb = new ProcessBuilder(); | ||
|
|
||
| pb.command(argList); |
Check failure
Code scanning / CodeQL
Uncontrolled command line
…o contrast-codesec
| } catch (IOException e) { | ||
| System.out.println("Problem executing cmdi - TestCase"); | ||
| response.getWriter() | ||
| .println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage())); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace
| try { | ||
| java.sql.Connection connection = | ||
| org.owasp.benchmark.helpers.DatabaseHelper.getSqlConnection(); | ||
| java.sql.CallableStatement statement = connection.prepareCall(sql); |
Check failure
Code scanning / CodeQL
Query built from user-controlled sources
| "Sensitive value '" | ||
| + org.owasp | ||
| .esapi | ||
| .ESAPI | ||
| .encoder() | ||
| .encodeForHTML(new String(input)) | ||
| + "' hashed and stored<br/>"); |
Check warning
Code scanning / CodeQL
Cross-site scripting
| user | ||
| + " has been remembered with cookie: " | ||
| + rememberMe.getName() | ||
| + " whose value is: " | ||
| + rememberMe.getValue() | ||
| + "<br/>"); |
Check warning
Code scanning / CodeQL
Cross-site scripting
|
@pixeebot next |
|
@davewichers, I don't have any suggestions at this time, but I am always learning, and I will let you know if anything comes up! |
| .encoder() | ||
| .encodeForHTML(fileTarget.toString()) | ||
| + "' created."); | ||
| if (fileTarget.exists()) { |
Check failure
Code scanning / CodeQL
Uncontrolled data used in path expression
|
|
||
| ProcessBuilder pb = new ProcessBuilder(); | ||
|
|
||
| pb.command(argList); |
Check failure
Code scanning / CodeQL
Uncontrolled command line
|
|
||
| response.setHeader("X-XSS-Protection", "0"); | ||
| Object[] obj = {"a", "b"}; | ||
| response.getWriter().format(java.util.Locale.US, param, obj); |
Check failure
Code scanning / CodeQL
Use of externally-controlled format string
|
|
||
| response.setHeader("X-XSS-Protection", "0"); | ||
| Object[] obj = {"a", "b"}; | ||
| response.getWriter().format(param, obj); |
Check failure
Code scanning / CodeQL
Use of externally-controlled format string
| (javax.naming.directory.InitialDirContext) ctx; | ||
| boolean found = false; | ||
| javax.naming.NamingEnumeration<javax.naming.directory.SearchResult> results = | ||
| idc.search(base, filter, filters, sc); |
Check failure
Code scanning / CodeQL
LDAP query built from user-controlled sources
|
|
||
| response.setHeader("X-XSS-Protection", "0"); | ||
| Object[] obj = {"a", "b"}; | ||
| response.getWriter().format(java.util.Locale.US, param, obj); |
Check warning
Code scanning / CodeQL
Cross-site scripting
| "LDAP query results: nothing found for query: " | ||
| + org.owasp.esapi.ESAPI.encoder().encodeForHTML(filter)); |
Check warning
Code scanning / CodeQL
Cross-site scripting
|
|
||
| response.setHeader("X-XSS-Protection", "0"); | ||
| Object[] obj = {"a", "b"}; | ||
| response.getWriter().format(param, obj); |
Check warning
Code scanning / CodeQL
Cross-site scripting
| "Access to file: '" | ||
| + org.owasp | ||
| .esapi | ||
| .ESAPI | ||
| .encoder() | ||
| .encodeForHTML(fileTarget.toString()) | ||
| + "' created."); |
Check warning
Code scanning / CodeQL
Cross-site scripting
|
@pixeebot next |
|
@davewichers, I don't have any suggestions at this time, but I am always learning, and I will let you know if anything comes up! |
Backport changes from main into this branch
| } catch (IOException e) { | ||
| System.out.println("Problem executing cmdi - TestCase"); | ||
| response.getWriter() | ||
| .println(org.owasp.esapi.ESAPI.encoder().encodeForHTML(e.getMessage())); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace
| response.getWriter() | ||
| .println( | ||
| "Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case"); | ||
| e.printStackTrace(response.getWriter()); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace
| response.getWriter() | ||
| .println( | ||
| "Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case"); | ||
| e.printStackTrace(response.getWriter()); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace
| response.getWriter() | ||
| .println( | ||
| "Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case"); | ||
| e.printStackTrace(response.getWriter()); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace
| response.getWriter() | ||
| .println( | ||
| "Problem executing crypto - javax.crypto.Cipher.getInstance(java.lang.String,java.security.Provider) Test Case"); | ||
| e.printStackTrace(response.getWriter()); |
Check warning
Code scanning / CodeQL
Information exposure through a stack trace
| javax.crypto.Cipher c = javax.crypto.Cipher.getInstance(algorithm); | ||
|
|
||
| // Prepare the cipher to encrypt | ||
| javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey(); |
Check failure
Code scanning / CodeQL
Use of a broken or risky cryptographic algorithm
| javax.crypto.Cipher c = | ||
| javax.crypto.Cipher.getInstance("DES/CBC/PKCS5Padding", "SunJCE"); | ||
| // Prepare the cipher to encrypt | ||
| javax.crypto.SecretKey key = javax.crypto.KeyGenerator.getInstance("DES").generateKey(); |
Check failure
Code scanning / CodeQL
Use of a broken or risky cryptographic algorithm
| cookie.setHttpOnly(true); | ||
| cookie.setPath(request.getRequestURI()); // i.e., set path to JUST this servlet | ||
| // e.g., /benchmark/sql-01/BenchmarkTest01001 | ||
| response.addCookie(cookie); |
Check warning
Code scanning / CodeQL
HTTP response splitting
| "Created cookie: 'SomeCookie': with value: '" | ||
| + org.owasp.esapi.ESAPI.encoder().encodeForHTML(str) | ||
| + "' and secure flag set to: true"); |
Check warning
Code scanning / CodeQL
Cross-site scripting
| "Sensitive value: '" | ||
| + org.owasp | ||
| .esapi | ||
| .ESAPI | ||
| .encoder() | ||
| .encodeForHTML(new String(input)) | ||
| + "' encrypted and stored<br/>"); |
Check warning
Code scanning / CodeQL
Cross-site scripting
|
@pixeebot next |
|
@davewichers, I don't have any suggestions at this time, but I am always learning, and I will let you know if anything comes up! |
| // System.out.println("Filter " + filter); | ||
| boolean found = false; | ||
| javax.naming.NamingEnumeration<javax.naming.directory.SearchResult> results = | ||
| ctx.search(base, filter, filters, sc); |
Check failure
Code scanning / CodeQL
LDAP query built from user-controlled sources
| "LDAP query results: nothing found for query: " | ||
| + org.owasp.esapi.ESAPI.encoder().encodeForHTML(filter)); |
Check warning
Code scanning / CodeQL
Cross-site scripting
| "No results returned for query: " | ||
| + org.owasp.esapi.ESAPI.encoder().encodeForHTML(sql)); |
Check warning
Code scanning / CodeQL
Cross-site scripting
| "Sensitive value '" | ||
| + org.owasp | ||
| .esapi | ||
| .ESAPI | ||
| .encoder() | ||
| .encodeForHTML(new String(input)) | ||
| + "' hashed and stored<br/>"); |
Check warning
Code scanning / CodeQL
Cross-site scripting
| user | ||
| + " has been remembered with cookie: " | ||
| + rememberMe.getName() | ||
| + " whose value is: " | ||
| + rememberMe.getValue() | ||
| + "<br/>"); |
Check warning
Code scanning / CodeQL
Cross-site scripting
| org.owasp.benchmark.helpers.DatabaseHelper.getSqlConnection(); | ||
| java.sql.PreparedStatement statement = | ||
| connection.prepareStatement( | ||
| sql, |
Check failure
Code scanning / CodeQL
Query built from user-controlled sources
| // org.owasp.benchmark.helpers.DatabaseHelper.JDBCtemplate.queryForLong(sql); | ||
| Long results = | ||
| org.owasp.benchmark.helpers.DatabaseHelper.JDBCtemplate.queryForObject( | ||
| sql, Long.class); |
Check failure
Code scanning / CodeQL
Query built from user-controlled sources
| response.getWriter().println("Welcome back: " + user + "<br/>"); | ||
| } else { | ||
| javax.servlet.http.Cookie rememberMe = | ||
| new javax.servlet.http.Cookie(cookieName, rememberMeKey); |
Check failure
Code scanning / CodeQL
Insecure randomness
|
@pixeebot next |
|
@davewichers, I don't have any suggestions at this time, but I am always learning, and I will let you know if anything comes up! |
No description provided.