CRITICAL
Rule Definition
The software constructs all or part of a system parameter via user-controllable inputs. These inputs are not neutralized or are incorrectly neutralized. As a consequence, some applications may work with an unexpected behavior.
Remediation
Assume all input is malicious.
Avoid using inputs. If it is not possible, use an "accept known good" input validation strategy, i.e., use stringent white-lists that limit the character set based on the expected value of the parameter in the request. This will indirectly limit the scope of an attack.
Violation Code Sample
// the arguments data and catalog are given by an API request
...
Properties props = System.getProperties();
props.setProperty("data", data);
...
conn.setCatalog(catalog);
...
Fixed Code Sample
...
Properties props = System.getProperties();
props.setProperty("data", hardcoded_data);
...
conn.setCatalog(hardcoded_catalog);
...
Reference
CWE-15: External Control of System or Configuration Setting
https://cwe.mitre.org/data/definitions/15.html
CWE-642: External Control of Critical State Data
https://cwe.mitre.org/data/definitions/642.html
Related Technologies
Technical Criterion
Secure Coding - Input Validation
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.