Sending HTTP requests is security-sensitive. It has led in the past to the following vulnerabilities:
An HTTP request has different kinds of vulnerabilities:
This rule flags code that initiates an HTTP request. The goal is to guide security code reviews.
You are at risk if you answered yes to any of those questions.
// === Java URL connection ===
import java.net.URL;
import java.net.HttpURLConnection;
abstract class URLConnection {
void foo() throws Exception {
URL url = new URL("http://example.com");
HttpURLConnection con = (HttpURLConnection) url.openConnection(); // Questionable: review how the http connection is used
doSomething((HttpURLConnection) url.openConnection()); // Questionable: review how the http connection is used
}
abstract void doSomething(HttpURLConnection httpUrlConnection);
}
// === HttpClient Java 9 ===
import jdk.incubator.http.HttpClient;
import jdk.incubator.http.HttpRequest;
import jdk.incubator.http.HttpResponse;
class JavaNet9 {
void foo(HttpRequest request, HttpResponse.BodyHandler<Object> responseBodyHandler, HttpResponse.MultiProcessor<?,?> multiProcessor) throws Exception {
HttpClient client = HttpClient.newHttpClient();
client.send(request, responseBodyHandler); // Questionable
client.sendAsync(request, responseBodyHandler); // Questionable
client.sendAsync(request, multiProcessor); // Questionable
}
}
// === HttpClient Java 10 ===
import jdk.incubator.http.HttpClient;
import jdk.incubator.http.HttpRequest;
import jdk.incubator.http.HttpResponse;
class JavaNet10 {
void foo(HttpRequest request, HttpResponse.BodyHandler<Object> responseBodyHandler, HttpResponse.MultiSubscriber<?,?> multiSubscriber) throws Exception {
HttpClient client = HttpClient.newHttpClient();
client.send(request, responseBodyHandler); // Questionable
client.sendAsync(request, responseBodyHandler); // Questionable
client.sendAsync(request, multiSubscriber); // Questionable
}
}
// === HttpClient Java 11 ===
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
class JavaNet11 {
void foo(HttpRequest request, HttpResponse.BodyHandler<Object> responseBodyHandler, HttpResponse.PushPromiseHandler<Object> pushPromiseHandler) throws Exception {
HttpClient client = HttpClient.newHttpClient();
client.send(request, responseBodyHandler); // Questionable
client.sendAsync(request, responseBodyHandler); // Questionable
client.sendAsync(request, responseBodyHandler, pushPromiseHandler); // Questionable
}
}
// === apache ===
import org.apache.http.client.HttpClient;
import org.apache.http.client.ResponseHandler;
import org.apache.http.client.methods.HttpUriRequest;
import org.apache.http.HttpClientConnection;
import org.apache.http.HttpEntityEnclosingRequest;
import org.apache.http.HttpHost;
import org.apache.http.HttpRequest;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.protocol.HttpContext;
class ApacheHttpClient {
void foo(HttpClientConnection con, HttpHost target, HttpRequest request, HttpContext context,
ResponseHandler<?> responseHandler, HttpUriRequest uriRequest, HttpEntityEnclosingRequest eeRequest)
throws Exception {
HttpClient client = HttpClientBuilder.create().build();
// All the following are Questionable
client.execute(target, request);
client.execute(target, request, context);
client.execute(target, request, responseHandler);
client.execute(target, request, responseHandler, context);
client.execute(uriRequest);
client.execute(uriRequest, context);
client.execute(uriRequest, responseHandler);
client.execute(uriRequest, responseHandler, context);
con.sendRequestEntity(eeRequest);
con.sendRequestHeader(request);
}
}
// === google-http-java-client ===
import java.util.concurrent.Executor;
import com.google.api.client.http.GenericUrl;
import com.google.api.client.http.HttpRequest;
import com.google.api.client.http.HttpRequestFactory;
import com.google.api.client.http.javanet.NetHttpTransport;
class GoogleHttpClient {
void foo(Executor executor) throws Exception {
HttpRequestFactory requestFactory = new NetHttpTransport().createRequestFactory();
HttpRequest request = requestFactory.buildGetRequest(new GenericUrl("http://example.com"));
// All the following are Questionable
request.execute();
request.executeAsync();
request.executeAsync(executor);
}
}