Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SECURITY] Update URLUtils to ensure secure connection #14

Open
jordanpadams opened this issue Aug 20, 2020 · 0 comments
Open

[SECURITY] Update URLUtils to ensure secure connection #14

jordanpadams opened this issue Aug 20, 2020 · 0 comments

Comments

@jordanpadams
Copy link
Member

jordanpadams commented Aug 20, 2020

Vulnerability

If possible always use setSecure to set the 'secure' flag on a cookie before adding it to an HttpServletResponse.

File Warning Line Notes
pds3-product-tools/src/main/java/gov/nasa/arc/pds/tools/util/URLUtils.java 225 Try to set secure before addCookie. ssoCookie.setSecure(true) plain text viewing possible if not set.
pds3-product-tools/src/main/java/gov/nasa/arc/pds/tools/util/URLUtils.java 258 Try to set secure before addCookie. ssoCookie.setSecure(true) plain text viewing possible if not set.
pds3-product-tools/src/main/java/gov/nasa/arc/pds/tools/util/URLUtils.java 316 Try to set secure before addCookie. ssoCookie.setSecure(true) plain text viewing possible if not set.
pds4-jparser/src/main/java/gov/nasa/arc/pds/tools/util/URLUtils.java 195 Try to set secure before addCookie. ssoCookie.setSecure(true) plain text viewing possible if not set.
pds4-jparser/src/main/java/gov/nasa/arc/pds/tools/util/URLUtils.java 228 Try to set secure before addCookie. ssoCookie.setSecure(true) plain text viewing possible if not set.
pds4-jparser/src/main/java/gov/nasa/arc/pds/tools/util/URLUtils.java 286 Try to set secure before addCookie. ssoCookie.setSecure(true) plain text viewing possible if not set.

Software Version

Current

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: ToDo
Development

No branches or pull requests

2 participants