Spring CSRF unrestricted RequestMapping

문서 > Datadog 보안 > Code Security > Static Code Analysis (SAST) > SAST 규칙 > Spring CSRF unrestricted RequestMapping

이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Metadata

ID: java-security/spring-csrf-requestmapping

Language: Java

Severity: Warning

Category: Security

CWE: 352

Description

Classes that contain methods annotated with RequestMapping are by default mapped to all the HTTP request methods.

Spring Security’s CSRF protection is not enabled by default for the HTTP request methods GET, HEAD, TRACE, and OPTIONS.

For this reason, requests or routes with RequestMapping, and not narrowing the mapping to the HTTP request methods POST, PUT, DELETE, or PATCH, makes them vulnerable to CSRF attacks.

Learn More

Spring CSRF unrestricted RequestMapping

Non-Compliant Code Examples

@Controller
public class ApplicationService extends BaseService {
    @RequestMapping(value = "/application.mvc", produces = "application/json")
    public @ResponseBody
    Application showApplication(HttpSession session) {
        Application app = Application.getInstance();
        return app;
    }

}

@Controller
public class UnsafeController {

    @RequestMapping("/path")
    public void writeData() {
        // State-changing operations performed within this method.
    }
}

Compliant Code Examples

@Controller
public class SafeController {

    /**
     * For methods without side-effects use @GetMapping.
     */
    @GetMapping("/path")
    public String readData() {
        // No state-changing operations performed within this method.
        return "";
    }

    /**
     * For state-changing methods use either @PostMapping, @PutMapping, @DeleteMapping, or @PatchMapping.
     */
    @PostMapping("/path")
    public void writeData() {
        // State-changing operations performed within this method.
    }

    /**
     * You can also use @RequestMapping if you specify a method
     */
    @RequestMapping(value = "/path2", method = RequestMethod.GET)
    public String readData2() {
        return "";
    }
}