SV.DOS.ARRINDEX

Tainted size used for array allocation

This error occurs when unvalidated user input is used as the index of an array or by methods that will use it as the index of an array.

As of release 2023.2, this checker supports Jakarta EE.

Vulnerability and risk

When unvalidated user input is used as the index of an array or by methods that will use it as the index of an array, an attack can cause the methods to throw an ArrayOutOfBounds exception. This can then be used to cause Denial of Service or to manipulate the stated object to create an alternate control flow, which could be used to the advantage of the attacker. For example, if an error is printed, it might leak some information to the attacker. If an error occurred during authentication, it could create open-on-fail conditions, allowing the attacker to get an unauthorized session.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

To prevent denial-of-service (DoS) attacks from user input, validate any and all input from outside the application (user input, file input, system parameters, and so on). Validation should include bounds validation using information from an appropriate, accessible container.

Vulnerable code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
     import javax.servlet.http.*;
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException,
                                                                                    IOException {
         String size = req.getParameter("size");
         final int value;
         try {
             value = Integer.parseInt(size);
         } catch (NumberFormatException e) {
             resp.sendError(505, "Internal Error");
             return;
         }
         String arr[] = new String[value];
         for (int i = 0; i < arr.length; i++) {
             arr[i] = req.getParameter("field" + i);
         }
         // ...
     }

SV.DOS.ARRSIZE is reported for line 12, indicating: 'size' contains a string coming from an HTTP request and thus can be tainted (line 4). On line 7, the tainted 'size' string is parsed and the result is stored in 'value', which is used on line 12 for array allocation. This leads to a potential DoS attack because an attacker can specify a large number, leading to high resource usage on the server.

Vulnerable code example 2

Copy

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
     import jakarta.servlet.http.*;
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException,
                                                                                    IOException {
         String size = req.getParameter("size");
         final int value;
         try {
             value = Integer.parseInt(size);
         } catch (NumberFormatException e) {
             resp.sendError(505, "Internal Error");
             return;
         }
         String arr[] = new String[value];
         for (int i = 0; i < arr.length; i++) {
             arr[i] = req.getParameter("field" + i);
         }
         // ...
     }

SV.DOS.ARRSIZE is reported for line 12, indicating: 'size' contains a string coming from an HTTP request and thus can be tainted (line 4). On line 7, the tainted 'size' string is parsed and the result is stored in 'value', which is used on line 12 for array allocation. This leads to a potential DoS attack because an attacker can specify a large number, leading to high resource usage on the server.

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Using Input From Untrusted Sources Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.