Trust_Boundary_Violation_in_Session_Variables @ EncodingAssignment.java

[nitinp1]

Trust_Boundary_Violation_in_Session_Variables issue exists @ EncodingAssignment.java in branch main

Method getBasicAuth at line 47 of /webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/EncodingAssignment.java gets user input from element request. This element’s value flows through the code without being properly sanitized or validated and is eventually stored in the server-side Session object, in getBasicAuth at line 54 of /webgoat-lessons/crypto/src/main/java/org/owasp/webgoat/crypto/EncodingAssignment.java. This constitutes a Trust Boundary Violation.

Namespace: nitinp1
Repository: WebGoat
Repository Url: https://github.com/nitinp1/WebGoat
CxAST-Project: nitinp1/WebGoat
CxAST platform scan: 371cf28e-43c8-4e90-86fa-65d2f0911dc1
Branch: main
Application: WebGoat
Severity: LOW
State: TO_VERIFY
Status: RECURRENT
CWE: 501
Lines: 47

---

References
Read more