spring boot - VeraCode static scan CWE-73: External Control of File Name or Path - Stack Overflow

admin管理员组

文章数量:1122832

My application Spring Boot 3 Mvc has the following controller method:

@RequestMapping(value = "/addToCart", method = RequestMethod.POST)
    public String addToCart(WebRequest webRequest, HttpServletRequest request) throws Exception {
        String[] quantity= request.getParameterValues("qty");
        String[] itemNumbers = request.getParameterValues("itemNumber");

        return addToCartHelper(webRequest, request, qtys, itemNumbers);
    }

VeraCode points to CWE-73 vulnerability on line "return addToCartHelper(webRequest, request, qtys, itemNumbers);"

CWE-73: External Control of File Name or Path: Link to description

Inside "addToCartHelper" method I access the MongoDB repository and generate the view URL for the redirect.

I don't interact with the file system.

Can you tell me how to fix the vulnerability?

My application Spring Boot 3 Mvc has the following controller method:

@RequestMapping(value = "/addToCart", method = RequestMethod.POST)
    public String addToCart(WebRequest webRequest, HttpServletRequest request) throws Exception {
        String[] quantity= request.getParameterValues("qty");
        String[] itemNumbers = request.getParameterValues("itemNumber");

        return addToCartHelper(webRequest, request, qtys, itemNumbers);
    }

VeraCode points to CWE-73 vulnerability on line "return addToCartHelper(webRequest, request, qtys, itemNumbers);"

CWE-73: External Control of File Name or Path: Link to description

Inside "addToCartHelper" method I access the MongoDB repository and generate the view URL for the redirect.

I don't interact with the file system.

Can you tell me how to fix the vulnerability?

• spring-boot
• spring-mvc
• veracode
• esapi

Share Improve this question Follow edited Nov 21, 2024 at 14:19 Heorhi Utseuski asked Nov 21, 2024 at 13:40 Heorhi UtseuskiHeorhi Utseuski 2366 bronze badges 2

• What is **CWE-73 vulnerability **. You expect us to know that... – M. Deinum Commented Nov 21, 2024 at 14:01
• @M.Deinum Sorry, I edited the question description, added a link to the description. – Heorhi Utseuski Commented Nov 21, 2024 at 14:20

Add a comment  | 

1 Answer 1

Sorted by: Reset to default 0

Your code has several problems from a security perspective, but first and foremost you're not even validating the parameters before you're using them. When receiving input from a user you always

1.) Assert that it's malicious 2.) Treat it as such

It's not clear why you're getting a path vuln flag, maybe see what happens if you send in <url>/addToCart/../../ and see what happens? Maybe at the root context of your application you're not defending against directory traversal which is more what this smells like based on the CWE-73.

But for sure, even if you clear CWE-73, you're not validating that the parameter values are

1.) In a valid range //String.length > 0 && String.length <= Integer.MAX_VALUE to get you started

2.) Are actually numbers (since that's what you expect) // [0-9]+

Afterwards, before you pass that data to the database, ensure they're using parameterized queries (or whatever the equivalent is in MongoDB).

At any rate, I'd answer the traversal question by using the testing guide I linked, and then determine if it's valid. You can also use a tool like DirBuster against a running instance of your web app to test and see if you're not handling paths correctly.

本文标签： spring bootVeraCode static scan CWE73 External Control of File Name or PathStack Overflow