|Join hundreds of other Developers and InfoSec professionals for Training, Sessions and Community at our first conference of 2019|
[AppSec Tel Aviv, May 26-30th]
Brief Overview of JSP Architecture
JSPs are delivered to a container that provides services like life-cycle management and runtime support. A JSP gets translated to a servlet class which is instantiated at runtime. A request headed for a particular JSP will be directed by the container to its corresponding servlet class (aka jsp implementation object). It then handles requests and generates responses. The default request response objects are HttpServletRequest and HttpServletResponse. JSP makes use of implicit objects that can be considered taint sources, sinks and propagators. I won't discuss further details since that is outside the scope of this project. For further information try this reference guide.
JSP In Light of Security
There’s not much to say here except that JSPs can act as both a model and view. It can operate fairly well without a distinct service or business layer because it doesn’t quite enforce separation of logic and concerns (hence the advent of development frameworks).
I won’t discuss details of web app design here, but one should understand that lack of separation can have negative effects on web-app stability and security. But even so, lack of input validation can lead to easy security vulns in JSP, namely XSS.
Commonly, JavaBeans are used in conjunction with JSP to store parameters and implement business logic. Most of my examples will use beans to demonstrate taint propagation and proper cleansing.
For more data on design with JSP and servlets, see this best practices article
JSP Standard Actions
This will attempt to set all bean properties with matching request parameters.
<jsp:useBean id="user" class="SessionBeans.UserSessionBean" scope="session"/> <jsp:setProperty name="user" property="*"/>
Later on another page...
<jsp:useBean id="user" class="SessionBeans.UserSessionBean" scope="session"/> <jsp:getProperty name="user" property="strParam"/>
Other ways to set properties: This sets a single bean property with the matching request parameter. This sets a single bean property with the supplied value. This sets a single bean property with the supplied value – contrived – point being to supply tainted data.
<jsp:setProperty name="user" property="strParam"/> <jsp:setProperty name="user" property="strParam" value="blah" /> <jsp:setProperty name="user" property="strParam" value="<%=request.getParameter("strParam")%>" />
JSP Implicit Objects
There are a handful of objects made available in JSPs which are susceptible to security flaws. Their corresponding java class functions are used as is in scriptlets. All the same security rules should apply.
|Implicit Object||Java Class||Relevant Functions|
|request||javax.servlet.ServletRequest|| getParameter(String parametername)
|out||javax.servlet.jsp.JspWriter|| print(char s)
<% String name = request.getParameter("username"); session.setAttribute("taintedAttribute", name); %>
my xss varible: <%=session.getAttribute("taintedAttribute", name)%>
see also [J2EE Bad Practices: JSP Expressions]