Improper Handling of Extra Parameters
The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
When applications receive duplicate parameters, they may process them inconsistently, leading to security bypasses or logic errors. Different frameworks may select the first, last, or combine duplicate parameters.
Jak naprawić tę podatność
Strategie zapobiegania dla Improper Handling of Extra Parameters oparte na 2 regułach detekcji Shoulder.
Add hpp middleware to normalize duplicate query parameters
+ const hpp = require('hpp'); + app.use(hpp()); + app.get('/search', (req, res) => { const role = req.query.role; if (role === 'admin') { res.json({ admin: true }); } });
Explicitly check for and reject duplicate HTTP parameters
- from flask import request - - @app.route('/api/action') - def action(): - user_id = request.args.get('id') - # Attacker sends: ?id=1&id=admin - # Only gets first value, but backend proxy may use last + from flask import request, jsonify + + @app.route('/api/action') + def action(): + all_ids = request.args.getlist('id') + if len(all_ids) != 1: + return jsonify({'error': 'Duplicate parameters not allowed'}), 400 + user_id = all_ids[0] perform_action(user_id)
Znajdz podatnosci w swoim kodzie
Uzyj Shoulder do skanowania kodu w poszukiwaniu wzorcow Improper Handling of Extra Parameters. 2 reguly.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=235 # Or scan entire project npx @shoulderdev/cli trust .
Reguly Wykrywania (2)
Na co zwracac uwage podczas przegladu kodu
Te wzorce wskazuja na potencjalne podatnosci Improper Handling of Extra Parameters. Szukaj ich podczas przegladow kodu i audytow bezpieczenstwa.
Przeskanuj swój kod w poszukiwaniu Improper Handling of Extra Parameters
Shoulder CLI znajduje podatne wzorce w całym Twoim kodzie.