Can't resolve Log Forging Fortify issue
It is possible to use fortify Java annotations to tell Fortify that the data returned from a sanitizing function is now safe.
When looking at my log forging problems I had strings coming in through a web API and thus had the flags XSS
and WEB
on my strings. I tried to find annotations that would only remove these flags, but couldn't find any way to remove the WEB
flag. The only documentation I've found is the Samples/advanced/javaAnnotation
directory.
Since my sanitation method does sanitize strings, I choose to remove all flags. This could be a problem though, as it could hide privacy violations.
@FortifyValidate("return")
private String sanitizeString(String taintedString) {
return doSomethingWithTheString(taintedString);
}