This error is detected when data from user input is traced to use in a potentially dangerous location. This error analyzes the flow of data from the input via HTTP requests from the web interface to its final destination in the application. This is useful for finding vulnerabilities that other unvalidated/tainted data error types may miss.

Vulnerability and risk

The use of unvalidated user input is, in general, a security vulnerability. Even if the current iteration of the application does not use it in a dangerous manner, future iterations may, and usually the data is assumed to be untainted. All user input should be checked for length and content at the point where it enters the application, so that subsequent use of this data is not vulnerable to attacks.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Mitigation of unvalidated user input, tainted data and other related vulnerabilities from user input can be achieved by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Typically only alphanumeric characters are needed (i.e., A-Za-z, 0-9). Any other accepted characters should be escaped. This validation should be done at each source of data, such as when each parameter is read from the HTTP request.

Example 1

14     protected void doPost(HttpServletRequest req, HttpServletResponse res) throws ServletException, IOException {
15         String act = req.getParameter("action");
16         String value = req.getParameter("actionValue");
17         System.setProperty(act, value);
18     }

SV.TAINT is reported for line 17: Potential tainted data vulnerability. Unchecked user data store in 'act' is entering a security-sensitive method.

Security guidelines

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.