User Input Security - how it works

Mon, 01 Jan 0001 00:00:00 +0000

Bytecode

The User Input Security feature incorporates a “Dataflow Engine” that uses intermediate bytecode (known as “CASTIL")that is produced during the analysis:

JEE technology	There are two bytecode generators: An extension called Security for Java is available - this can be manually included in Console using the Application - Extensions interface or can be automatically installed in v 1.x when delivering source code via the "Security assessment" Objective. The JEE Analyzer also generates intermediate bytecode "out of the box". CAST highly recommends that the Security for Java extension is used since the bytecode it generates produces much more accurate results for the User Input Security feature.
.NET technology	The bytecode is generated by the .NET Analyzer.

JEE technology

There are two bytecode generators:

An extension called Security for Java is available - this can be manually included in Console using the Application - Extensions interface or can be automatically installed in v 1.x when delivering source code via the "Security assessment" Objective.
The JEE Analyzer also generates intermediate bytecode "out of the box".

CAST highly recommends that the Security for Java extension is used since the bytecode it generates produces much more accurate results for the User Input Security feature.

.NET technology

The bytecode is generated by the .NET Analyzer.

Dataflow Engine

The Dataflow Engine uses a tainted variable mechanism to track the user input that has not been sanitized. The engine will track vulnerabilities via tainted data that flows from the user input down to the target methods, as shown in the image below showing an “SQL Injection” scenario:

User Input Security - predefined methods

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: Some well known Input Methods/Target Methods are already pre-defined and taken into account by CAST for the User Security Input feature. You do not need to specifically add any of the methods defined on this page.

JEE

Input methods

JEE methods defined as input methods

[rt.jar]java.io.Console.readLine()
[rt.jar]java.io.Console.readLine([rt.jar]java.lang.String,[rt.jar]java.lang.Object[])
[rt.jar]java.io.Console.readPassword()
[rt.jar]java.io.Console.readPassword([rt.jar]java.lang.String,[rt.jar]java.lang.Object[])
[rt.jar]java.applet.Applet.getParameter([rt.jar]java.lang.String)
[rt.jar]java.applet.Applet.getParameterInfo()
[rt.jar]java.awt.TextArea.getSelectedText()
[rt.jar]java.awt.TextArea.getText()
[rt.jar]java.awt.TextArea.getTextListeners()
[rt.jar]java.awt.TextComponent.getSelectedText()
[rt.jar]java.awt.TextComponent.getText()
[rt.jar]java.awt.TextComponent.getTextListeners()
[rt.jar]java.awt.TextField.getSelectedText()
[rt.jar]java.awt.TextField.getText()
[rt.jar]java.awt.TextField.getTextListeners()
[rt.jar]javax.swing.JApplet.getParameter([rt.jar]java.lang.String)
[rt.jar]javax.swing.JApplet.getParameterInfo()
[rt.jar]javax.swing.JEditorPane.getSelectedText()
[rt.jar]javax.swing.JEditorPane.getText()
[rt.jar]javax.swing.JEditorPane.getText([ext]int,[ext]int)
[rt.jar]javax.swing.JFormattedTextField.getSelectedText()
[rt.jar]javax.swing.JFormattedTextField.getText()
[rt.jar]javax.swing.JFormattedTextField.getText([ext]int,[ext]int)
[rt.jar]javax.swing.JPasswordField.getSelectedText()
[rt.jar]javax.swing.JPasswordField.getText()
[rt.jar]javax.swing.JPasswordField.getText([ext]int,[ext]int)
[rt.jar]javax.swing.JTextArea.getSelectedText()
[rt.jar]javax.swing.JTextArea.getText()
[rt.jar]javax.swing.JTextArea.getText([ext]int,[ext]int)
[rt.jar]javax.swing.JTextField.getSelectedText()
[rt.jar]javax.swing.JTextField.getText()
[rt.jar]javax.swing.JTextField.getText([ext]int,[ext]int)
[rt.jar]javax.swing.JTextPane.getSelectedText()
[rt.jar]javax.swing.JTextPane.getText()
[rt.jar]javax.swing.JTextPane.getText([ext]int,[ext]int)
[rt.jar]javax.swing.text.JTextComponent.getSelectedText()
[rt.jar]javax.swing.text.JTextComponent.getText()
[rt.jar]javax.swing.text.JTextComponent.getText([ext]int,[ext]int)
[rt.jar]javax.swing.tree.DefaultTreeCellEditor/DefaultTextField.getSelectedText()
[rt.jar]javax.swing.tree.DefaultTreeCellEditor/DefaultTextField.getText()
[rt.jar]javax.swing.tree.DefaultTreeCellEditor/DefaultTextField.getText([ext]int,[ext]int)

[javax.servlet_3.0.0.jar]javax.servlet.ServletRequest.getParameter([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.ServletRequest.getParameterNames()
[javax.servlet_3.0.0.jar]javax.servlet.ServletRequest.getParameterValues([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.ServletRequest.getParameterMap()
[javax.servlet_3.0.0.jar]javax.servlet.ServletResponse.getCharacterEncoding()
[javax.servlet_3.0.0.jar]javax.servlet.ServletResponse.getContentType()
[javax.servlet_3.0.0.jar]javax.servlet.ServletResponse.getBufferSize()
[javax.servlet_3.0.0.jar]javax.servlet.ServletResponse.getLocale()
[javax.servlet_3.0.0.jar]javax.servlet.ServletRequestWrapper.getParameter([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.ServletRequestWrapper.getParameterNames()
[javax.servlet_3.0.0.jar]javax.servlet.ServletRequestWrapper.getParameterValues([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.ServletRequestWrapper.getParameterMap()
[javax.servlet_3.0.0.jar]javax.servlet.ServletResponseWrapper.getCharacterEncoding()
[javax.servlet_3.0.0.jar]javax.servlet.ServletResponseWrapper.getContentType()
[javax.servlet_3.0.0.jar]javax.servlet.ServletResponseWrapper.getBufferSize()
[javax.servlet_3.0.0.jar]javax.servlet.ServletResponseWrapper.getLocale()
[javax.servlet_3.0.0.jar]javax.servlet.http.Cookie.getValue()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequest.getHeader([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequest.getHeaders([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequest.getHeaderNames()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequest.getQueryString()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequest.getParameter([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequest.getParameterNames()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequest.getParameterValues([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequest.getParameterMap()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequestWrapper.getParameter([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequestWrapper.getParameterNames()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequestWrapper.getParameterValues([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequestWrapper.getParameterMap()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequestWrapper.getHeader([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequestWrapper.getHeaders([ext]java.lang.String)
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequestWrapper.getHeaderNames()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletRequestWrapper.getQueryString()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletResponseWrapper.getCharacterEncoding()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletResponseWrapper.getContentType()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletResponseWrapper.getBufferSize()
[javax.servlet_3.0.0.jar]javax.servlet.http.HttpServletResponseWrapper.getLocale()

[1-javax.jar]javax.servlet.ServletRequest.getParameter([ext]java.lang.String)
[1-javax.jar]javax.servlet.ServletRequest.getParameterNames()
[1-javax.jar]javax.servlet.ServletRequest.getParameterValues([ext]java.lang.String)
[1-javax.jar]javax.servlet.ServletRequest.getParameterMap()
[1-javax.jar]javax.servlet.ServletResponse.getBufferSize()
[1-javax.jar]javax.servlet.ServletResponse.getCharacterEncoding()
[1-javax.jar]javax.servlet.ServletResponse.getLocale()
[1-javax.jar]javax.servlet.ServletResponse.getContentType()
[1-javax.jar]javax.servlet.http.Cookie.getValue()
[1-javax.jar]javax.servlet.http.HttpServletRequest.getHeader([ext]java.lang.String)
[1-javax.jar]javax.servlet.http.HttpServletRequest.getHeaderNames()
[1-javax.jar]javax.servlet.http.HttpServletRequest.getHeaders([ext]java.lang.String)
[1-javax.jar]javax.servlet.http.HttpServletRequest.getQueryString()
[1-javax.jar]javax.servlet.http.HttpServletRequest.getParameter([ext]java.lang.String)
[1-javax.jar]javax.servlet.http.HttpServletRequest.getParameterNames()
[1-javax.jar]javax.servlet.http.HttpServletRequest.getParameterValues([ext]java.lang.String)
[1-javax.jar]javax.servlet.http.HttpServletRequest.getParameterMap()
[1-javax.jar]javax.servlet.http.HttpServletResponse.getCharacterEncoding()
[1-javax.jar]javax.servlet.http.HttpServletResponse.getContentType()
[1-javax.jar]javax.servlet.http.HttpServletResponse.getBufferSize()
[1-javax.jar]javax.servlet.http.HttpServletResponse.getLocale()

[spring-web.jar]org.springframework.web.multipart.MultipartHttpServletRequest.getHeader([ext]java.lang.String)
[spring-web.jar]org.springframework.web.multipart.MultipartHttpServletRequest.getHeaders([ext]java.lang.String)
[spring-web.jar]org.springframework.web.multipart.MultipartHttpServletRequest.getHeaderNames()
[spring-web.jar]org.springframework.web.multipart.MultipartHttpServletRequest.getQueryString()
[spring-web.jar]org.springframework.web.multipart.MultipartHttpServletRequest.getParameter([ext]java.lang.String)
[spring-web.jar]org.springframework.web.multipart.MultipartHttpServletRequest.getParameterNames()
[spring-web.jar]org.springframework.web.multipart.MultipartHttpServletRequest.getParameterValues([ext]java.lang.String)
[spring-web.jar]org.springframework.web.multipart.MultipartHttpServletRequest.getParameterMap()

Target methods

Info

Note: “+ctor” means “constructor”

User Input Security - manually configuring blackbox methods

Mon, 01 Jan 0001 00:00:00 +0000

Info

Summary: this page explains how to manually configure “blackbox methods” for the User Input Security feature.

Introduction

When analyzing an application, this application has a defined analysis scope - i.e. some code is analyzed, some is not and is treated as external code. Any external code is “unknown” and cannot be accessed by the analyzer, and as such cannot be taken into account in the normal manner by the User Input Security feature. Therefore, security problems in this external source code would normally not be detected at all.

User Input Security - Using FlawExplorer to speed up result check

Mon, 01 Jan 0001 00:00:00 +0000

Introduction

If it is necessary to fine tune elements of the User Input Security configuration without running an entire snapshot or if it is necessary to browse the User Input Security results without using the CAST Engineering Dashboard, it is possible to use an unsupported CAST tool called the FlawExplorer to visualize the flaws. It takes in input “.flaw” files, and lets you browse the flaws that have been generate during the snapshot. In addition, since the FlawExplorer is an “offline” tool, you can browse flaw files without having to connect to a CAST Management Service.

Application - Security Dataflow on Documentation - V2

User Input Security - how it works

Bytecode

Dataflow Engine

User Input Security - predefined methods

JEE

Input methods

Target methods

User Input Security - manually configuring blackbox methods

Introduction

User Input Security - Using FlawExplorer to speed up result check

Introduction