Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

New rule : Detect dynamic JSP Includes #104

Closed
h3xstream opened this issue Oct 3, 2015 · 0 comments
Closed

New rule : Detect dynamic JSP Includes #104

h3xstream opened this issue Oct 3, 2015 · 0 comments
Assignees
@h3xstream
Labels
enhancement New feature or improvement to existing detector.
Milestone
version-1.4.4

Comments

@h3xstream
Copy link
Member

Detect jsp include where the source included is dynamically constructed.

Unsafe samples

<jsp:include page="${param.secret_param_page}" />
<c:import url="${param.secret_param_page}" />

Safe samples

<%@include file="${param.secret_param_page}"%> <!--  file param can not be dynamic-->
<jsp:include page="header.jsp" /> <!--  static value -->
<c:import url="header.jsp" /> <!--  static value -->
@h3xstream h3xstream added the enhancement New feature or improvement to existing detector. label Oct 3, 2015
@h3xstream h3xstream self-assigned this Oct 3, 2015
@h3xstream h3xstream added this to the version-1.4.4 milestone Oct 3, 2015
@h3xstream h3xstream changed the title New rule : Detect dynamic JSP Include New rule : Detect dynamic JSP Includes Oct 3, 2015
@h3xstream h3xstream mentioned this issue Oct 14, 2015
Closed
5 tasks
h3xstream added a commit that referenced this issue Oct 17, 2015
@h3xstream
JSP include detection rule #104
44a4155
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@h3xstream h3xstream

Labels
enhancement New feature or improvement to existing detector.
Projects
None yet
Milestone
version-1.4.4
Development

No branches or pull requests
1 participant
@h3xstream