[
https://issues.apache.org/jira/browse/OFBIZ-9823?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Michael Brohl closed OFBIZ-9823.
--------------------------------
Resolution: Implemented
Fix Version/s: Upcoming Release
Thanks Dennis,
your patch is in trunk r1817692.
The patch was modified because the repeated conditional check in
TrackingCodeEvents was simplified too much.
> [FB] Package org.apache.ofbiz.marketing.tracking
> ------------------------------------------------
>
> Key: OFBIZ-9823
> URL:
https://issues.apache.org/jira/browse/OFBIZ-9823> Project: OFBiz
> Issue Type: Sub-task
> Components: marketing
> Affects Versions: Trunk
> Reporter: Dennis Balkir
> Assignee: Michael Brohl
> Priority: Minor
> Fix For: Upcoming Release
>
> Attachments: OFBIZ-9823_org.apache.ofbiz.marketing.tracking_bugfixes.patch
>
>
> --- TrackingCodeEvents.java:261, RpC_REPEATED_CONDITIONAL_TEST
> RpC: Repeated conditional test in org.apache.ofbiz.marketing.tracking.TrackingCodeEvents.processTrackingCode(GenericValue, HttpServletRequest, HttpServletResponse, String)
> The code contains a conditional test is performed twice, one right after the other (e.g., x == 0 || x == 0). Perhaps the second occurrence is intended to be something else (e.g., x == 0 || y == 0).
> --- TrackingCodeEvents.java:261, RCN_REDUNDANT_NULLCHECK_OF_NONNULL_VALUE
> RCN: Redundant nullcheck of visitorSiteId, which is known to be non-null in org.apache.ofbiz.marketing.tracking.TrackingCodeEvents.processTrackingCode(GenericValue, HttpServletRequest, HttpServletResponse, String)
> This method contains a redundant check of a known non-null value against the constant null.
> --- TrackingCodeEvents.java:263, HRS_REQUEST_PARAMETER_TO_COOKIE
> HRS: HTTP cookie formed from untrusted input in org.apache.ofbiz.marketing.tracking.TrackingCodeEvents.processTrackingCode(GenericValue, HttpServletRequest, HttpServletResponse, String)
> This code constructs an HTTP Cookie using an untrusted HTTP parameter. If this cookie is added to an HTTP response, it will allow a HTTP response splitting vulnerability. See
http://en.wikipedia.org/wiki/HTTP_response_splitting for more information.
> FindBugs looks only for the most blatant, obvious cases of HTTP response splitting. If FindBugs found any, you almost certainly have more vulnerabilities that FindBugs doesn't report. If you are concerned about HTTP response splitting, you should seriously consider using a commercial static analysis or pen-testing tool.
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
Locked
