Conversation
|
|
||
|
|
||
| KEY_SIZE = 1024 | ||
|
|
There was a problem hiding this comment.
| MOCK_FIX |
IAC
Finding Type Name
Description
MOCK_DESCRIPTIONBenchmarks
- MOCK_BENCH_1
- MOCK_BENCH_2
|
|
||
|
|
||
| KEY_SIZE = 1024 | ||
|
|
There was a problem hiding this comment.
SECRETS
Base64 High Entropy String (:warning: Valid)
Description
Entropy check
|
|
||
|
|
||
| KEY_SIZE = 1024 | ||
|
|
There was a problem hiding this comment.
LICENSE
PackageName:1.0.0 / ec2.tf
Non Compliant License (MIT)
Description
Non Compliant License
|
|
||
|
|
||
| KEY_SIZE = 1024 | ||
|
|
There was a problem hiding this comment.
SAST
External control of system or configuration setting
Source File: ExternalControlOfSystemOrConfigurationSetting1-taint3.java, Sink File: ExternalControlOfSystemOrConfigurationSetting1-taint3.java
Data Flow
ExternalControlOfSystemOrConfigurationSetting1-taint3.java
13 | String tainted = req.getParameter("input");
ExternalControlOfSystemOrConfigurationSetting1-taint3.java
14 | c.setCatalog(tainted);
How To Fix
String userInput = request.getParameter("catalogName");
if(isValidCatalogName(userInput)) {
connection.setCatalog(userInput);
}
Description
This SAST policy detects instances where user input is used in the java.sql.Connection's setCatalog call. This can be a potential issue as it may allow attackers to change the database during a connection, leading to disruptions or unexpected behaviors.
Vulnerable code example:
java
String userInput = request.getParameter("catalogName");
connection.setCatalog(userInput);
In the above code, the setCatalog method uses user input catalogName directly without any validation or sanitization. This allows an attacker to manipulate the catalogName parameter and potentially change the database being accessed.
|
|
||
|
|
||
| KEY_SIZE = 1024 | ||
|
|
There was a problem hiding this comment.
SCA
MOCK_PACKAGE_NAME 1.1.2 / ec2.tf
Total vulnerabilities: 2
| Critical: 1 | High: 1 | Medium: 0 | Low: 0 |
|---|
| Vulnerability ID | Severity | CVSS | Fixed in | Status |
|---|---|---|---|---|
| CVE-2022-1650 |  CRITICAL |
9.3 | 1.1.1 |
Open |
| CVE-2020-7788 |  HIGH |
7.3 | 1.0.5 |
Open |
1 participant
No description provided.