Q
Detector Library
Scala detectors (28/28)
Improper Neutralization of Special Elements in Data QueryAvoid Persistent CookiesImproper AuthenticationArgument InjectionInsecure host name verifierInsecure CryptographyTemplate InjectionUntrusted data in http sessionInsecure servlet handlingInsecure connection using unencrypted protocolDeserialization of Untrusted DataInsecure servlet handlingUse of Insufficiently Random ValuesInsecure cookieUse Of RSA AlgorithmPath TraversalURL redirection to untrusted siteImproper Validation Of Array IndexInsufficient Protected CredentialsInsecure jax endpoint usageXML External EntityInsecure CORS policyExternal Access to Files or DirectoriesIncorrect Certificate Hostname VerificationImproper privilege managementCross-site scriptingImproper Certificate ValidationDisabled HTML autoescape
Insecure cookie High
Insecure cookie settings can lead to unencrypted cookie transmission. Even if a cookie doesn't contain sensitive data now, sensitive data could be added later. It's good practice to transmit all cookies only through secure channels.
Detector ID
scala/insecure-cookie@v1.0
Category
Noncompliant example
1def nonCompliant(res: HttpServletResponse): Unit = {
2 val cookie = new Cookie("key", "value")
3 cookie.setSecure(true)
4 cookie.setHttpOnly(true)
5 // Noncompliant: MaxAge set to one year.
6 cookie.setMaxAge(31536000)
7 res.addCookie(cookie)
8}
Compliant example
1def compliant(res: HttpServletResponse): Unit = {
2 val cookie = new Cookie("key", "value")
3 cookie.setSecure(true)
4 cookie.setHttpOnly(true)
5 // Compliant: MaxAge set to one week.
6 cookie.setMaxAge(604800)
7 res.addCookie(cookie)
8}