Amazon QDetector Library Sign in to Amazon Q

Amazon Q

Detector Library

Scala detectors (48/48)

Improper Neutralization of Special Elements in Data Query Cookie Without Http Only Flag EL Injection Avoid Persistent Cookies OS command injection Improper Authentication Argument Injection Insecure host name verifier Server-Side Request Forgery Insecure Cryptography Template Injection Expression Language Injection Integer Overflow Log Injection Untrusted data in http session LDAP Injection Insecure LDAP Configuration SMTP injection Insecure connection using unencrypted protocol Deserialization of Untrusted Data HTTP response splitting Insecure servlet handling Incorrect Permission Assignment Improper handling of unicode encoding SQL injection Use of Insufficiently Random Values Insecure cookie Code Injection CRLF Injection Use Of RSA Algorithm Path Traversal URL redirection to untrusted site Improper Validation Of Array Index Hardcoded credentials Insufficient Protected Credentials Insecure jax endpoint usage XML External Entity Insecure CORS policy JS eval External Access to Files or Directories Incorrect Certificate Hostname Verification Externally-Controlled Format String NoSQL injection Improper privilege management Cross Site Request Forgery Cross-site scripting Improper Certificate Validation Disabled HTML autoescape

EL Injection Critical

Potential EL injection vulnerability found. User input is directly used in creating or evaluating EL expressions without proper validation or sanitization. The source of the value(s) should be verified to avoid that unfiltered values fall into this risky code evaluation.

Detector ID

scala/el-injection@v1.0

Category

Common Weakness Enumeration (CWE)

Tags

# injection # owasp-top10