java: false positive: javax.validation.constraints are not identified as input validation
- Vorherrschende Sprache
- CodeQL
- Sterne
- 10.1k
- Forks
- 2.1k
- Ø Merge
- 2 T. 15 Std.
- Gemergte PRs (30 T.)
- 141
Beschreibung
**Description of the false positive**
`java.validation.constraints.*` are not identified for input validation. For example in following example the `id` path param is considered to be insecure.
Example
```java
import javax.validation.constraints.Max;
import javax.validation.constraints.Min;
import javax.validation.constraints.NotNull;
import javax.ws.rs.DefaultValue;
import javax.ws.rs.GET;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.Produces;
import javax.ws.rs.core.MediaType;
@Path("/")
@Produces(MediaType.APPLICATION_JSON)
public interface API {
@GET
@Produces(MediaType.APPLICATION_JSON)
@Path("/api/v1/thing/{id}")
Something get(@NotNull @PathParam("id") @Min(1) @Max(30) @DefaultValue("1") Integer id);
}
```
Beitragsleitfaden
Bewertung
Dieses Issue wurde noch nicht bewertet.