SV.DATA.BOUND
This error occurs when unvalidated user data is stored in semi-trusted storage such as session attributes.
As of release 2023.2, this checker supports Jakarta EE.
Vulnerability and risk
A source such as getParameter() is always considered to be tainted, and users must do server validation for it. Server validation involves reading data read from other structures, such as session attributes or the database, considered to be safe. By storing unchecked user data in such structures, you risk allowing other vulnerabilities to occur.
Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.
Mitigation and prevention
Validate user data before you enter it into a trusted source, such as a database or session attributes.
Example 1
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
String name = req.getParameter("userName");
HttpSession sess = req.getSession();
sess.setAttribute("user", name);
}SV.DATA.BOUND is reported for line 18: unvalidated user input stored in 'name' on line 16 is stored in the HTTP session on line 18.
External guidance
Security training
Application security training materials provided by Secure Code Warrior.
Extension
This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.
