KAgrawal524237 (Community Member) asked a question.
Information Exposure (CWE-201)
private void addStdSecureResponseHeaders(HttpServletResponse httpResponse,HttpServletRequest httpRequest) {
httpResponse.addHeader("X-FRAME-OPTIONS", "SAMEORIGIN");
httpResponse.addHeader("X-XSS-Protection", "1; mode=block");
if (httpRequest.isSecure())
httpResponse.addHeader("Strict-Transport-Security", "max-age=31622400; includeSubDomains"); // Issue shows up here
// Some more headers....
}
How to fix this?
.png){kind=logo}
Hi @KAgrawal524237 (Community Member),
Veracode Static Analysis reports CWE 201 (Insertion of Sensitive Information Into Sent Data) when it detects "sensitive" data sent out of the application. Configuration and properties are often marked as sensitive. The concern is that credentials or private messages leave the application. Or that an attacker could use the information for further attacks. This flaw is Low severity as integrity and availability are not a concern, only confidentiality.
The question we ask is whether this data really is sensitive or not. These findings give the opportunity to review the sensitivity.
If there are no sensitive data, or the data are used correctly, please feel free to propose a mitigation. Explain where the data originates and why you think they are not sensitive. If they are sensitive, ensure that the transfer of it is by-design and does not violate policy.
If you still have questions, I recommend scheduling a consultation call to discuss.
Kind regards,
Duncan