Example 4: Validation in depth
When you scan the Example 4 code, the first scan includes
three AppScan® Source
traces with
a root at the corresponding trace routines. Assume the selection of
the FileInputStream.read
method in trace1
and
the addition of the validate
routine. The section
following the sample source code describes the effects of each scope
for the validation routine.
public class TestCase_IOT_UserValidation {
ResultSet resultSet;
FileInputStream fileInputStream;
PrintWriter printWriter;
byte[] buffer;
public static void main(String[] args) throws Exception {
TestCase_IOT_UserValidation testCase = new TestCase_IOT_UserValidation();
testCase.trace1();
TestCase_IOT_UserValidation testCase2 = new TestCase_IOT_UserValidation();
testCase2.trace2();
TestCase_IOT_UserValidation testCase3 = new TestCase_IOT_UserValidation();
testCase3.trace3();
}
private void trace1() throws Exception {
String source = getVulnerableSource1();
source = validate(source);
writeToVulnerableSink(source);
}
private void trace2() throws Exception {
String source = getVulnerableSource2();
source = validate(source);
writeToVulnerableSink(source);
}
private void trace3() throws Exception {
String source = getVulnerableSource3();
source = validate(source);
writeToVulnerableSink(source);
}
public String getVulnerableSource1() throws Exception {
fileInputStream.read(buffer);
return new String(buffer);
}
public String getVulnerableSource2() throws Exception {
fileInputStream.read(buffer);
return new String(buffer);
}
public String getVulnerableSource3() throws Exception {
return resultSet.getString("x");
}
public void writeToVulnerableSink(String str) throws Exception {
printWriter.write(str);
}
private String validate(String source) throws Exception {
// validate
return source;
}
}
Call site specific validation routine - input for
this call to FileInputStream.read
Create
a call site specific validation routine when the validation only fits
in a very narrow context or where the input method is too generic
to supply one validation routine. When you Apply to this
call to FileInputStream.read in the trace1
method, trace1
does
not appear as a finding after the next scan because its call stack
includes a call to the validate
method. However, trace2
is
still reported even though it calls validate
, because
the scope of the validation routine is tied to the trace1
call
site. The trace3
method also calls validate
,
but it continues to be reported because it uses ResultSet.getString
as
a source.
API specific validation routine - input for any call
to FileInputStream.read
Create an API specific
validation routine when the validation is only applicable for a particular
source. When you Apply to any call to FileInputStream.read method,
both the trace1
and trace2
methods
are clear of findings on the next scan because they include a call
to the validate
method. However, the trace3
method
continues to exist even though it calls validate
because
it uses ResultSet.getString
as a source.