Spring Security - 1.2

Description

In what situation should you install this extension?

This extension provides specific rules for the Spring Security technology. These rules are compliant with CWE and OWASP TOP 10 Standards for Security.

How to identify if an application is using Spring Security?

Check for the presence of the Spring Security Filter in the web.xml file:

<filter>
    <filter-name>springSecurityFilterChain</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>

Check for a dependency of spring-security-web and spring-security-config in the pom.xml file:

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
    <version>${spring.version}</version>
</dependency>
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
    <version>${spring.version}</version>
</dependency>

Transactions

Transaction support is derived from metamodel concepts used to build CAST Imaging Blueprint and structural transaction flows. Entry Points start transactions; Exit Points include both output/boundary concepts and Data Entities manipulated by transactions.

ISO 5055 Structural Rules

Quality support is based on ISO 5055 structural rules available for the selected extension version.

Supported Spring Security and Framework versions

This extension is compatible with the following Spring Security and Framework versions:

Packaging, delivering and analyzing your source code

Once the extension is downloaded and installed, there is nothing specific to do: analyze your source code with the JEE Analyzer and the rules will be triggered.

What results can you expect?

Once the analysis/snapshot generation has completed, you can view the results in the normal manner.

Structural rules

The following structural rules are provided:

• 1.2.19-funcrel 
• 1.2.18-funcrel 
• 1.2.17-funcrel 
• 1.2.16-funcrel 
• 1.2.15-funcrel 
• 1.2.14-funcrel 
• 1.2.13-funcrel 
• 1.2.12-funcrel 
• 1.2.11-funcrel 
• 1.2.10-funcrel 
• 1.2.9-funcrel 
• 1.2.8-funcrel 
• 1.2.7-funcrel 
• 1.2.6-funcrel 
• 1.2.5-funcrel 
• 1.2.4-funcrel 
• 1.2.3-funcrel 
• 1.2.2-funcrel 
• 1.2.1-funcrel - Extension withdrawn
• 1.2.0-funcrel