Classes that contain methods annotated with RequestMapping are by default mapped to all the HTTP request methods.
Spring Security’s CSRF protection is not enabled by default for the HTTP request methods GET, HEAD, TRACE, and OPTIONS.
For this reason, requests or routes with RequestMapping, and not narrowing the mapping to the HTTP request methods POST, PUT, DELETE, or PATCH, makes them vulnerable to CSRF attacks.
@ControllerpublicclassUnsafeController{@RequestMapping("/path")publicvoidwriteData(){// State-changing operations performed within this method.}}
Compliant Code Examples
@ControllerpublicclassSafeController{/**
* For methods without side-effects use @GetMapping.
*/@GetMapping("/path")publicStringreadData(){// No state-changing operations performed within this method.return"";}/**
* For state-changing methods use either @PostMapping, @PutMapping, @DeleteMapping, or @PatchMapping.
*/@PostMapping("/path")publicvoidwriteData(){// State-changing operations performed within this method.}/**
* You can also use @RequestMapping if you specify a method
*/@RequestMapping(value="/path2",method=RequestMethod.GET)publicStringreadData2(){return"";}}
シームレスな統合。 Datadog Code Security をお試しください
Datadog Code Security
このルールを試し、Datadog Code Security でコードを解析する
このルールの使用方法
1
2
rulesets:- java-security # Rules to enforce Java security.