Loading…
8
Took 3 days to get our SAST tool to stop flagging a fake SQL injection in a Spring app
We had a scan that kept reporting a critical SQLi in a controller that only did a simple JPA findById call. Turns out the tool was tainting the path variable through a custom validation annotation we wrote 2 years ago. I had to dig through the rule configs and add an exclusion for our annotation, which took way longer than it should have. Has anyone else run into a tool that can't understand custom annotations, or is it just me?
2 comments
Log in to join the discussion
Log In2 Comments
phoenix_thompson429d ago
Wait, a custom annotation from two years ago is what threw off the whole scan? That's wild, you'd think the tool would at least learn your own codebase after all that time. Adding an exclusion manually feels like such a hack for something that should just work.
5
miles7229d ago
My 6 year old dishwasher has a "smart" sensor that still can't tell the difference between a cereal bowl and a baking sheet. We keep making excuses for machines that are supposed to adapt, then act surprised when they don't. At some point you just learn the workaround and stop waiting for the upgrade.
5