JAVA.IO.TAINT.XML : Tainted XML (Java)

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

Tainted data flows into a field annotated as @XMLTrusted, or into a method that writes or creates an XML object.

Checks for this class use the CodeSonar Java taint analysis. See Taint Tracking for CodeSonar Java Warning Classes for more information on this analysis, including lists of the methods that CodeSonar automatically recognizes as relevant and information about specifying additional methods that CodeSonar should recognize as taint sources, sinks, or sanitizers.

Use configuration parameter JAVA_ANALYSIS_ADVANCED_INJECTION to specify the level of checking to perform for this and other taint-related warning classes:

For basic checking, set JAVA_ANALYSIS_ADVANCED_INJECTION=No in your project configuration file.

For advanced checking, set JAVA_ANALYSIS_ADVANCED_INJECTION=Yes.

クラス名

Tainted XML (Java)

日本語クラス名

Tainted XML (Java)

クラス分類

セキュリティ (security)

ニーモニック

JAVA.IO.TAINT.XML

カテゴリー

CWE	CWE:74	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CERT-Java	CERT-Java:IDS14-J	Do not trust the contents of hidden form fields
DISA-6r1	DISA-6r1:V-222608	The application must not be vulnerable to XML-oriented attacks.
DISA-5r3	DISA-5r3:V-70269	The application must not be vulnerable to XML-oriented attacks.
DISA-4r3	DISA-4r3:V-70269	The application must not be vulnerable to XML-oriented attacks.
OWASP-2017	OWASP-2017:A1	Injection
OWASP-2021	OWASP-2021:A3	Injection

対応言語

Java で利用可能です。

有効/無効設定

このワーニングクラスのチェックはデフォルトで有効になっています。チェックを無効にするにはプロジェクト設定ファイル（configuration file）に以下の WARNING_FILTER ルールを追加してください。

WARNING_FILTER += discard class="Tainted XML (Java)"

Verify that a security error actually corresponds to unconstrained information flow from source locations into sink locations. If this is the case, add a sanitizing algorithm to clean data before it flows into sinks, or use safe statements to propagate data inside the program.

設定ファイルの以下のパラメータがこのワーニングクラスのチェックに影響します。

JAVA.IO.TAINT.XML : Tainted XML (Java)

要旨

プロパティ

解決法

関連のある設定ファイルパラメータ