Test case 48721

Deprecated test case

This version contains mistakes, making it deprecated. Deprecated test cases should not be used for new work. However, They remain in the SARD as a reference to redo previous work.

Type: source code
State: mixed
Status: deprecated
Language: Java
Submission Date: 08 Apr 2011

Description

CWE: 113 HTTP Response Splitting
BadSource: getParameterServlet Read data from a querystring using getParameter
GoodSource: A hardcoded string
Sinks: setHeaderServlet
GoodSink: URLEncode input
BadSink : querystring to setHeader()
Flow Variant: 41 Data flow: data passed as an argument from one method to another in the same class

Flaws

CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Test Suites

Documentation

Juliet v1.0 for Java cases.pdf

Trace

- CWE113_HTTP_Response_Splitting__getParameterServlet_setHeaderServlet_41.javaline 35
  - CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Files

src

main

java

testcases

CWE113_HTTP_Response_Splitting

CWE113_HTTP_Response_Splitting__getParameterServlet_setHeaderServlet_41.java

testcasesupport

AbstractTestCaseServlet.java

IO.java

manifest.sarif


xxxxxxxxxx
111
 
1
/* TEMPLATE GENERATED TESTCASE FILE
2
Filename: CWE113_HTTP_Response_Splitting__getParameterServlet_setHeaderServlet_41.java
3
Label Definition File: CWE113_HTTP_Response_Splitting.label.xml
4
Template File: sources-sinks-41.tmpl.java
5
*/
6
/*
7
 * @description
8
 * CWE: 113 HTTP Response Splitting
9
 * BadSource: getParameterServlet Read data from a querystring using getParameter
10
 * GoodSource: A hardcoded string
11
 * Sinks: setHeaderServlet
12
 *    GoodSink: URLEncode input
13
 *    BadSink : querystring to setHeader()
14
 * Flow Variant: 41 Data flow: data passed as an argument from one method to another in the same class
15
 *
16
 * */
17
18
package testcases.CWE113_HTTP_Response_Splitting;
19
20
import testcasesupport.*;
21
22
import javax.servlet.http.*;
23
24
import java.util.logging.Logger;
25
26
import java.net.URLEncoder;
27
28
public class CWE113_HTTP_Response_Splitting__getParameterServlet_setHeaderServlet_41 extends AbstractTestCaseServlet
29
{
30
31
    private void bad_sink(String data , HttpServletRequest request, HttpServletResponse response) throws Throwable
32
    {
33
34
        /* POTENTIAL FLAW: Input not verified before inclusion in header */
35
        response.setHeader("Location", "/author.jsp?lang=" + data);
36
37
    }
38
39
    public void bad(HttpServletRequest request, HttpServletResponse response) throws Throwable
40
    {
41
        String data;
42
43
        Logger log_bad = Logger.getLogger("local-logger");
44
45
        /* read parameter from request */
46
        data = request.getParameter("name");
47
48
        bad_sink(data , request, response );
49
    }
50
51
    public void good(HttpServletRequest request, HttpServletResponse response) throws Throwable
52
    {
53
        goodG2B(request, response);
54
        goodB2G(request, response);
55
    }
56
57
    private void goodG2B_sink(String data , HttpServletRequest request, HttpServletResponse response) throws Throwable
58
    {
59
60
        /* POTENTIAL FLAW: Input not verified before inclusion in header */
61
        response.setHeader("Location", "/author.jsp?lang=" + data);
62
63
    }
64
65
    /* goodG2B() - use goodsource and badsink */
66
    private void goodG2B(HttpServletRequest request, HttpServletResponse response) throws Throwable
67
    {
68
        String data;
69
70
        java.util.logging.Logger log_good = java.util.logging.Logger.getLogger("local-logger");
71
72
        /* FIX: Use a hardcoded string */
73
        data = "foo";
74
75
        goodG2B_sink(data , request, response );
76
    }
77
78
    private void goodB2G_sink(String data , HttpServletRequest request, HttpServletResponse response) throws Throwable
79
    {
80
81
        /* FIX: use URLEncoder.encode to hex-encode non-alphanumerics */
82
        data = URLEncoder.encode(data, "UTF-16");
83
        response.setHeader("Location", "/author.jsp?lang=" + data);
84
85
    }
86
87
    /* goodB2G() - use badsource and goodsink */
88
    private void goodB2G(HttpServletRequest request, HttpServletResponse response) throws Throwable
89
    {
90
        String data;
91
92
        Logger log_bad = Logger.getLogger("local-logger");
93
94
        /* read parameter from request */
95
        data = request.getParameter("name");
96
97
        goodB2G_sink(data , request, response );
98
    }
99
100
    /* Below is the main(). It is only used when building this testcase on
101
       its own for testing or for building a binary to use in testing binary
102
       analysis tools. It is not used when compiling all the testcases as one
103
       application, which is how source code analysis tools are tested. */
104
    public static void main(String[] args) throws ClassNotFoundException,
105
           InstantiationException, IllegalAccessException
106
    {
107
        mainFromParent(args);
108
    }
109
110
}
111

Have any comments on this test case? Please, send us an email.