Package com.h3xstream.findsecbugs.injection.trust

Class TrustBoundaryViolationAttributeDetector

  • All Implemented Interfaces:
    edu.umd.cs.findbugs.Detector, edu.umd.cs.findbugs.Priorities
    public class TrustBoundaryViolationAttributeDetector
extends BasicInjectionDetector

    Trust Boundary Violation is fancy name to describe tainted value passed directly to session attribute. This could be an expected behavior that allow an attacker to change the session state.

    When the attribute name is dynamic, it is a lot more suspicious than when it is a dynamic value. setAttribute( suspiciousValue, "true") vs setAttribute( "language" , commonDynamicValue)

    For this reason, the trust boundary violation was split in two detector.

    See Also:
    TrustBoundaryViolationValueDetector

    • Constructor Detail

      • TrustBoundaryViolationAttributeDetector

        public TrustBoundaryViolationAttributeDetector​(edu.umd.cs.findbugs.BugReporter bugReporter)

    • Method Detail

      • getPriority

        protected int getPriority​(Taint taint)
        All or nothing :
        • If the taint to sink path is found, it is mark as high
        • If the source is not confirm, it is mark as low. This is will be the most common case.
        Overrides:
        getPriority in class AbstractInjectionDetector
        Parameters:
        taint - Taint state
        Returns:
        High or low confidence