SV.DOS.ARRSIZE
This error is detected when unvalidated user input is used as an array size or in methods that will use it as an array size.
As of release 2023.2, this checker supports Jakarta EE.
Vulnerability and risk
The use of data from outside the application must be validated before use by the application. If this data is used to allocate arrays of objects in the application, the content of the data must be closely checked. Attackers can exploit this vulnerability to force the application to allocate very large numbers of objects, leading to high resource usage on the application server and the potential for a denial-of-service (DoS) condition.
Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.
Mitigation and prevention
The prevention of DoS attacks from user input can be achieved by validating any and all input from outside the application (user input, file input, system parameters, etc.). Validation should include length and content. Ideally, sizes for objects should not come from untrusted user sources such as parameters. This validation should be done at each source of data, such as when each parameter is read from the HTTP request. Data used for allocation should also be checked for reasonable values, assuming that user input could contain very small or vary large values.
Example 1
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException,
IOException {
String size = req.getParameter("size");
final int value;
try {
value = Integer.parseInt(size);
} catch (NumberFormatException e) {
resp.sendError(505, "Internal Error");
return;
}
String arr[] = new String[value];
for (int i = 0; i < arr.length; i++) {
arr[i] = req.getParameter("field" + i);
}
// ...
}SV.DOS.ARRSIZE is reported for line 24: 'size' contains a string coming from an HTTP request and thus can be tainted (line 16). On line 19 tainted 'size' string is parsed and the result is stored in 'value', which is used on line 24 for array allocation. This leads to a potential DoS attack: an attacker can specify a large number, leading to high resource usage on the server.
External guidance
Extension
This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.