Taint Sanitizers for CodeSonar Java Warning Classes

• Overview
• Specifying Additional Sanitizers
• Sanitizers Automatically Recognized

Overview

Sanitizers are methods that remove taint from information that passes through them, so that the information can no longer be used to construct injection attacks. Information that originates from a method identified as a taint source will trigger a CodeSonar warning if it enters a taint sink without passing through a sanitizer.

For example, a method that escapes HTML or JavaScript tags might be considered a sanitizer.

The CodeSonar Java analysis automatically recognizes a number of methods as sanitizers. You can also use annotations to specify additional methods that the analysis should treat as sanitizers.

Specifying Additional Sanitizers

If you have a sanitizer method that is not automatically recognized, you can instruct the CodeSonar analysis to treat it as a sanitizer by annotating its return type with one of the annotations from the following table.

• In general, a sanitizer method will only sanitize its input with respect to one aspect of taint. For example, if we have a method that ensures a string does not contain a URL, that method will generally not also sanitize SQL components in the string. The different annotations in the table reflect sanitization for a variety of different issues, each of which is associated with a specific warning class.
• Annotating a void return causes the receiving object to be treated as sanitized.

For example, suppose we have a method mySqlSanitizer that returns an SQL-escaped version of its String parameter.

String mySqlSanitizer(String instr){
      // ...
}     

This method removes SQL taint, so we annotate its return value with @SqlTrusted:

@SqlTrusted String mySqlSanitizer(String instr){
      // ...
}     

Sanitizers Automatically Recognized

The methods listed below are automatically recognized as sanitizers by CodeSonar. The relevant annotation from the table above is shown for each method. For example,

indicates that the value returned by this value has been sanitized of URL taint and so will not trigger a Tainted URL (Java) warning if it flows into a location identified as a sink for URL taint.

• java2
• java5
• java8

java2

• @CrossSiteTrusted String org.apache.commons.lang.StringEscapeUtils.escapeHtml(String arg0)
• @CrossSiteTrusted String org.apache.commons.lang3.StringEscapeUtils.escapeHtml3(String arg0)
• @CrossSiteTrusted String org.apache.commons.lang3.StringEscapeUtils.escapeHtml4(String arg0)

java5

• @CrossSiteTrusted String org.owasp.esapi.Encoder.encodeForHTML(String arg0)
• @AttributeTrusted String org.owasp.esapi.Encoder.encodeForLDAP(String arg0)
• @CommandTrusted String org.owasp.esapi.Encoder.encodeForOS(Codec arg0, String arg1)
• @SqlTrusted String org.owasp.esapi.Encoder.encodeForSQL(Codec arg0, String arg1)
• @UrlTrusted String org.owasp.esapi.Encoder.encodeForURL(String arg0)
• @XPathTrusted String org.owasp.esapi.Encoder.encodeForXPath(String arg0)
• @CrossSiteTrusted String org.springframework.web.util.HtmlUtils.htmlEscape(String arg0, String arg1)
• @CrossSiteTrusted String org.springframework.web.util.HtmlUtils.htmlEscape(String arg0)
• @CrossSiteTrusted String org.springframework.web.util.HtmlUtils.htmlEscapeDecimal(String arg0)
• @CrossSiteTrusted String org.springframework.web.util.HtmlUtils.htmlEscapeDecimal(String arg0, String arg1)
• @CrossSiteTrusted String org.springframework.web.util.HtmlUtils.htmlEscapeHex(String arg0, String arg1)
• @CrossSiteTrusted String org.springframework.web.util.HtmlUtils.htmlEscapeHex(String arg0)

java8

• @CrossSiteTrusted String org.apache.commons.text.StringEscapeUtils.escapeHtml3(String arg0)
• @CrossSiteTrusted String org.apache.commons.text.StringEscapeUtils.escapeHtml4(String arg0)