The use of data from outside the application must be validated before use by the application. If this data is used to allocate arrays of objects in the application, the content of the data must be closely checked. Attackers can exploit this vulnerability to force the application to allocate very large numbers of objects, leading to high resource usage on the application server and the potential for a denial-of-service (DoS) condition.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

The prevention of DoS attacks from user input can be achieved by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Ideally, sizes for objects should not come from untrusted user sources such as parameters. This validation should be done at each source of data, such as when each parameter is read from the HTTP request. Data used for allocation should also be checked for reasonable values, assuming that user input could contain very small or vary large values.

Example 1

14     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException,
15                                                                                    IOException {
16         String size = req.getParameter("size");
17         final int value;
18         try {
19             value = Integer.parseInt(size);
20         } catch (NumberFormatException e) {
21             resp.sendError(505, "Internal Error");
22             return;
23         }
24         String arr[] = new String[value];
25         for (int i = 0; i < arr.length; i++) {
26             arr[i] = req.getParameter("field" + i);
27         }
28         // ...
29     }

SV.DOS.ARRSIZE is reported for line 24: 'size' contains a string coming from an HTTP request and thus can be tainted (line 16). On line 19 tainted 'size' string is parsed and the result is stored in 'value', which is used on line 24 for array allocation. This leads to a potential DoS attack: an attacker can specify a large number, leading to high resource usage on the server.

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.