Skip to content

Commit

Permalink
Deploying to gh-pages from @ 38c07d1 🚀
Browse files Browse the repository at this point in the history
  • Loading branch information
@sebastien-andrivet-sonarsource
sebastien-andrivet-sonarsource committed Sep 29, 2023
1 parent 7747fe6 commit f690174
Show file tree
Hide file tree
Showing 3 changed files with 85 additions and 123 deletions.
103 changes: 42 additions & 61 deletions rules/S6377/default-description.html
View file
Original file line number Diff line number Diff line change
@@ -1,52 +1,53 @@
<div class="sect1">
<h2 id="_description">Description</h2>
<div class="sectionbody">
<div class="paragraph">
<p>XML signatures are a method used to ensure the integrity and authenticity of XML documents. However, if XML signatures are not validated securely, it can lead to potential vulnerabilities.</p>
</div>

</div>
</div>
<div class="sect1">
<h2 id="_why_is_this_an_issue">Why is this an issue?</h2>
<div class="sectionbody">
<div class="paragraph">
<p>Before Java 17, XML Digital Signature API does not apply restrictions on XML signature validation unless the application runs with a security manager, which is rare.</p>
</div>
<p>XML signature validations work by parsing third-party data that cannot be trusted until it is actually validated.</p>
</div>
</div>
<div class="sect1">
<h2 id="_what_is_the_potential_impact">What is the potential impact</h2>
<div class="sectionbody">
<div class="paragraph">
<p>By not enforcing secure validation, the XML Digital Signature API is more susceptible to attacks such as signature spoofing and injections.</p>
<p>As with any other parsing process, unrestricted validation of third-party XML signatures can lead to security vulnerabilities. In this case, threats range from denial of service to confidentiality breaches.</p>
</div>
<div class="sect2">
<h3 id="_increased_vulnerability_to_signature_spoofing">Increased Vulnerability to Signature Spoofing</h3>
<div class="paragraph">
<p>By disabling secure validation, the Java application becomes more susceptible to signature spoofing attacks. Attackers can potentially manipulate the XML signature in a way that bypasses the validation process, allowing them to forge or tamper with the signature. This can lead to the acceptance of invalid or maliciously modified signatures, compromising the integrity and authenticity of the XML documents.</p>
</div>
</div>
<div class="sect2">
<h3 id="_risk_of_injection_attacks">Risk of Injection Attacks</h3>
<div class="paragraph">
<p>Disabling secure validation can expose the application to injection attacks. Attackers can inject malicious code or entities into the XML document, taking advantage of the weakened validation process. In some cases, it can also expose the application to denial-of-service attacks. Attackers can exploit vulnerabilities in the validation process to cause excessive resource consumption or system crashes, leading to service unavailability or disruption.</p>
</div>
</div>
<p>By default, the Java XML Digital Signature API does not apply restrictions on XML signature validation, unless the application runs with a security manager.<br>
To protect the application from these vulnerabilities, set the <code>org.jcp.xml.dsig.secureValidation</code> attribute to <code>true</code> with the <code>javax.xml.crypto.dsig.dom.DOMValidateContext.setProperty</code> method.<br>
This attribute ensures that the code enforces the following restrictions:</p>
</div>
<div class="ulist">
<ul>
<li>
<p>Forbids the use of XSLT transforms</p>
</li>
<li>
<p>Restricts the number of <code>SignedInfo</code> or <code>Manifest Reference</code> elements to 30 or less</p>
</li>
<li>
<p>Restricts the number of <code>Reference</code> transforms to 5 or less</p>
</li>
<li>
<p>Forbids the use of MD5-related signatures or MAC algorithms</p>
</li>
<li>
<p>Ensures that <code>Reference</code> IDs are unique to help prevent signature wrapping attacks</p>
</li>
<li>
<p>Forbids Reference URIs of type <code>http</code>, <code>https</code>, or <code>file</code></p>
</li>
<li>
<p>Does not allow a <code>RetrievalMethod</code> element to reference another <code>RetrievalMethod</code> element</p>
</li>
<li>
<p>Forbids RSA or DSA keys less than 1024 bits</p>
</li>
</ul>
</div>
<div class="sect1">
<h2 id="_how_to_fix_it_in_java_se">How to fix it in Java SE</h2>
<div class="sectionbody">
<div class="sect2">
<h3 id="_code_examples">Code examples</h3>
<div class="paragraph">
<p>For versions of Java before 17, secure validation is disabled by default unless the application runs with a security manager, which is rare. It should be enabled explicitly by setting the <code>org.jcp.xml.dsig.secureValidation</code> attribute to true with the <code>javax.xml.crypto.dsig.dom.DOMValidateContext.setProperty</code> method.</p>
</div>
<div class="paragraph">
<p>For Java 17 and higher, secure validation is enabled by default.</p>
</div>
<div class="sect3">
<h4 id="_noncompliant_code_example">Noncompliant code example</h4>
<h3 id="_noncompliant_code_example">Noncompliant code example</h3>
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">NodeList signatureElement = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
Expand All @@ -59,8 +60,11 @@ <h4 id="_noncompliant_code_example">Noncompliant code example</h4>
</div>
</div>
</div>
<div class="sect3">
<h4 id="_compliant_solution">Compliant solution</h4>
<div class="sect2">
<h3 id="_compliant_solution">Compliant solution</h3>
<div class="paragraph">
<p>In order to benefit from this secure validation mode, set the DOMValidateContext&#8217;s <code>org.jcp.xml.dsig.secureValidation</code> property to <code>TRUE</code>.</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">NodeList signatureElement = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
Expand All @@ -75,49 +79,26 @@ <h4 id="_compliant_solution">Compliant solution</h4>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_how_does_this_work">How does this work?</h3>
<div class="paragraph">
<p>When XML Signature secure validation mode is enabled, XML Signatures are processed more securely. It enforces a number of restrictionsto to protect from XML Documents that may contain hostile constructs that can cause denial-of-service or other types of security issues.</p>
</div>
<div class="paragraph">
<p>These restrictions can protect you from XML Signatures that may contain potentially hostile constructs that can cause denial-of-service or other types of security issues.</p>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_resources">Resources</h2>
<div class="sectionbody">
<div class="sect2">
<h3 id="_documentation">Documentation</h3>
<div class="ulist">
<ul>
<li>
<p>Oracle Java Documentation - <a href="https://docs.oracle.com/en/java/javase/21/security/java-xml-digital-signature-api-overview-and-tutorial.html">XML Digital Signature API Overview and Tutorial</a></p>
</li>
</ul>
</div>
</div>
<div class="sect2">
<h3 id="_standards">Standards</h3>
<div class="ulist">
<ul>
<li>
<p>OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10:2021 A02:2021 - Cryptographic Failures</a></p>
<p><a href="https://docs.oracle.com/en/java/javase/14/security/java-xml-digital-signature-api-overview-and-tutorial.html#GUID-DB46A001-6DBD-4571-BDBC-1BBC394BF61E">Oracle Java Documentation</a> - XML Digital Signature API Overview and Tutorial</p>
</li>
<li>
<p>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 -Sensitive Data Exposure</a></p>
<p><a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">OWASP Top 10 2017 Category A3</a> - Sensitive Data Exposure</p>
</li>
<li>
<p>CWE - <a href="https://cwe.mitre.org/data/definitions/347">CWE-347 - Improper Verification of Cryptographic Signature</a></p>
<p><a href="https://cwe.mitre.org/data/definitions/347">MITRE, CWE-347</a> - Improper Verification of Cryptographic Signature</p>
</li>
</ul>
</div>
<hr>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_implementation_specification">Implementation Specification</h2>
<div class="sectionbody">
Expand Down
103 changes: 42 additions & 61 deletions rules/S6377/java-description.html
View file
Original file line number Diff line number Diff line change
@@ -1,52 +1,53 @@
<div class="sect1">
<h2 id="_description">Description</h2>
<div class="sectionbody">
<div class="paragraph">
<p>XML signatures are a method used to ensure the integrity and authenticity of XML documents. However, if XML signatures are not validated securely, it can lead to potential vulnerabilities.</p>
</div>

</div>
</div>
<div class="sect1">
<h2 id="_why_is_this_an_issue">Why is this an issue?</h2>
<div class="sectionbody">
<div class="paragraph">
<p>Before Java 17, XML Digital Signature API does not apply restrictions on XML signature validation unless the application runs with a security manager, which is rare.</p>
</div>
<p>XML signature validations work by parsing third-party data that cannot be trusted until it is actually validated.</p>
</div>
</div>
<div class="sect1">
<h2 id="_what_is_the_potential_impact">What is the potential impact</h2>
<div class="sectionbody">
<div class="paragraph">
<p>By not enforcing secure validation, the XML Digital Signature API is more susceptible to attacks such as signature spoofing and injections.</p>
<p>As with any other parsing process, unrestricted validation of third-party XML signatures can lead to security vulnerabilities. In this case, threats range from denial of service to confidentiality breaches.</p>
</div>
<div class="sect2">
<h3 id="_increased_vulnerability_to_signature_spoofing">Increased Vulnerability to Signature Spoofing</h3>
<div class="paragraph">
<p>By disabling secure validation, the Java application becomes more susceptible to signature spoofing attacks. Attackers can potentially manipulate the XML signature in a way that bypasses the validation process, allowing them to forge or tamper with the signature. This can lead to the acceptance of invalid or maliciously modified signatures, compromising the integrity and authenticity of the XML documents.</p>
</div>
</div>
<div class="sect2">
<h3 id="_risk_of_injection_attacks">Risk of Injection Attacks</h3>
<div class="paragraph">
<p>Disabling secure validation can expose the application to injection attacks. Attackers can inject malicious code or entities into the XML document, taking advantage of the weakened validation process. In some cases, it can also expose the application to denial-of-service attacks. Attackers can exploit vulnerabilities in the validation process to cause excessive resource consumption or system crashes, leading to service unavailability or disruption.</p>
</div>
</div>
<p>By default, the Java XML Digital Signature API does not apply restrictions on XML signature validation, unless the application runs with a security manager.<br>
To protect the application from these vulnerabilities, set the <code>org.jcp.xml.dsig.secureValidation</code> attribute to <code>true</code> with the <code>javax.xml.crypto.dsig.dom.DOMValidateContext.setProperty</code> method.<br>
This attribute ensures that the code enforces the following restrictions:</p>
</div>
<div class="ulist">
<ul>
<li>
<p>Forbids the use of XSLT transforms</p>
</li>
<li>
<p>Restricts the number of <code>SignedInfo</code> or <code>Manifest Reference</code> elements to 30 or less</p>
</li>
<li>
<p>Restricts the number of <code>Reference</code> transforms to 5 or less</p>
</li>
<li>
<p>Forbids the use of MD5-related signatures or MAC algorithms</p>
</li>
<li>
<p>Ensures that <code>Reference</code> IDs are unique to help prevent signature wrapping attacks</p>
</li>
<li>
<p>Forbids Reference URIs of type <code>http</code>, <code>https</code>, or <code>file</code></p>
</li>
<li>
<p>Does not allow a <code>RetrievalMethod</code> element to reference another <code>RetrievalMethod</code> element</p>
</li>
<li>
<p>Forbids RSA or DSA keys less than 1024 bits</p>
</li>
</ul>
</div>
<div class="sect1">
<h2 id="_how_to_fix_it_in_java_se">How to fix it in Java SE</h2>
<div class="sectionbody">
<div class="sect2">
<h3 id="_code_examples">Code examples</h3>
<div class="paragraph">
<p>For versions of Java before 17, secure validation is disabled by default unless the application runs with a security manager, which is rare. It should be enabled explicitly by setting the <code>org.jcp.xml.dsig.secureValidation</code> attribute to true with the <code>javax.xml.crypto.dsig.dom.DOMValidateContext.setProperty</code> method.</p>
</div>
<div class="paragraph">
<p>For Java 17 and higher, secure validation is enabled by default.</p>
</div>
<div class="sect3">
<h4 id="_noncompliant_code_example">Noncompliant code example</h4>
<h3 id="_noncompliant_code_example">Noncompliant code example</h3>
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">NodeList signatureElement = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
Expand All @@ -59,8 +60,11 @@ <h4 id="_noncompliant_code_example">Noncompliant code example</h4>
</div>
</div>
</div>
<div class="sect3">
<h4 id="_compliant_solution">Compliant solution</h4>
<div class="sect2">
<h3 id="_compliant_solution">Compliant solution</h3>
<div class="paragraph">
<p>In order to benefit from this secure validation mode, set the DOMValidateContext&#8217;s <code>org.jcp.xml.dsig.secureValidation</code> property to <code>TRUE</code>.</p>
</div>
<div class="listingblock">
<div class="content">
<pre class="highlight"><code class="language-java" data-lang="java">NodeList signatureElement = doc.getElementsByTagNameNS(XMLSignature.XMLNS, "Signature");
Expand All @@ -75,49 +79,26 @@ <h4 id="_compliant_solution">Compliant solution</h4>
</div>
</div>
</div>
<div class="sect2">
<h3 id="_how_does_this_work">How does this work?</h3>
<div class="paragraph">
<p>When XML Signature secure validation mode is enabled, XML Signatures are processed more securely. It enforces a number of restrictionsto to protect from XML Documents that may contain hostile constructs that can cause denial-of-service or other types of security issues.</p>
</div>
<div class="paragraph">
<p>These restrictions can protect you from XML Signatures that may contain potentially hostile constructs that can cause denial-of-service or other types of security issues.</p>
</div>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_resources">Resources</h2>
<div class="sectionbody">
<div class="sect2">
<h3 id="_documentation">Documentation</h3>
<div class="ulist">
<ul>
<li>
<p>Oracle Java Documentation - <a href="https://docs.oracle.com/en/java/javase/21/security/java-xml-digital-signature-api-overview-and-tutorial.html">XML Digital Signature API Overview and Tutorial</a></p>
</li>
</ul>
</div>
</div>
<div class="sect2">
<h3 id="_standards">Standards</h3>
<div class="ulist">
<ul>
<li>
<p>OWASP - <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">Top 10:2021 A02:2021 - Cryptographic Failures</a></p>
<p><a href="https://docs.oracle.com/en/java/javase/14/security/java-xml-digital-signature-api-overview-and-tutorial.html#GUID-DB46A001-6DBD-4571-BDBC-1BBC394BF61E">Oracle Java Documentation</a> - XML Digital Signature API Overview and Tutorial</p>
</li>
<li>
<p>OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 -Sensitive Data Exposure</a></p>
<p><a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">OWASP Top 10 2017 Category A3</a> - Sensitive Data Exposure</p>
</li>
<li>
<p>CWE - <a href="https://cwe.mitre.org/data/definitions/347">CWE-347 - Improper Verification of Cryptographic Signature</a></p>
<p><a href="https://cwe.mitre.org/data/definitions/347">MITRE, CWE-347</a> - Improper Verification of Cryptographic Signature</p>
</li>
</ul>
</div>
<hr>
</div>
</div>
</div>
<div class="sect1">
<h2 id="_implementation_specification">Implementation Specification</h2>
<div class="sectionbody">
Expand Down
2 changes: 1 addition & 1 deletion rules/rule-index.json
View file

Large diffs are not rendered by default.

0 comments on commit f690174

Please sign in to comment.