Prevent HTTP parameter pollution

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください

Metadata

ID: java-security/http-parameter-pollution

Language: Java

Severity: Warning

Category: Security

Description

Do not concatenate HTTP parameters. Instead, use a proper API to set each parameter.

Learn More

Non-Compliant Code Examples

class Main {
    public void myMethod() {
        String input = request.getParameter("lang");
        GetMethod get = new GetMethod("https://api.endoint/path/to/api");
        get.setQueryString("param1=" + param1Value);

        if (true) {
            get.setQueryString("param1=" + param1Value);
        } else {
            get.setQueryString("param1=" + param1Value);
        }
        get.execute();
    }
}

Compliant Code Examples

class Main {
    public void myMethod() {
        URIBuilder uriBuilder = new URIBuilder("https://api.endoint/path/to/api");
        uriBuilder.addParameter("param1", param1Value);

        HttpGet httpget = new HttpGet(uriBuilder.build().toString());
    }
}
https://static.datadoghq.com/static/images/logos/github_avatar.svg https://static.datadoghq.com/static/images/logos/vscode_avatar.svg jetbrains

Seamless integrations. Try Datadog Code Analysis