Abhishek M (Community Member) asked a question.
I have a jsp page in which i am forwarding some info to another jsp by using <jsp:forward> , previously i had applied veracode supported cleansers to sanitize the parameters inside the forward but still CWE 601 got reported, so i switched to allow-list, where i only allow the forward to happen after i check if the jsp is present in allow list or not, even after applying this veracode is still flagging CWE 601
Code:
static List<String> UrlList = (ArrayList<String>)Arrays.asList(new String[]{
"my.jsp",
"new.jsp",
"hello.jsp",});
public static boolean isSafeJSPPage(String page) {
if (UrlList != null && page != null) {
for (String allowedPage : UrlList) {
if (page.equalsIgnoreCase(allowedPage)) {
return true;
}
}
}
return false;
}
If the jsp is appears to be in list the isSafeJSPPage will return true.
Implementation :
String rdrt = my.jsp;
if (SafeJSPPage(rdrt)){%>
<jsp:forward page="<%= rdrt %>">
<jsp:param name="message" value="hello" />
</jsp:forward>
.png){kind=logo}
Hi,
Veracode Static Analysis employs a technique called "Data Flow Analysis" this means that it traces a value through a program as it if were a river of data.
It only recognize a value as safe it it always originates from a safe source, validating the data even if it originates from an unsafe source will not be automatically recognized.
You will need to write the validation so that the data is always returned from the hardcoded list.
You can find more information on this here: https://community.veracode.com/s/article/Using-an-Allow-list-in-a-Way-Static-Analysis-can-Detect .
Thank you,
Boy Baukema