This rule should raise when:
- the argument of loadUserByUsername(String username) is used in the message of any kind of exceptions, see CustomAuthenticationProvider.java file on security-expected-issues for a sensitive example.
- setHideUserNotFoundExceptions(boolean) is set to false, setHideUserNotFoundExceptions method exists for these types:
- https://docs.spring.io/spring-security/site/docs/4.0.x/apidocs/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.html#setHideUserNotFoundExceptions-boolean-
and all inherited types: - https://docs.spring.io/spring-security/site/docs/4.0.x/apidocs/org/springframework/security/authentication/dao/DaoAuthenticationProvider.html
- https://docs.spring.io/spring-security/site/docs/4.0.x/apidocs/org/springframework/security/ldap/authentication/LdapAuthenticationProvider.html
See WebSecurityConfig.java on security-expected-issues for an example of sensitive ccode
- https://docs.spring.io/spring-security/site/docs/4.0.x/apidocs/org/springframework/security/authentication/dao/AbstractUserDetailsAuthenticationProvider.html#setHideUserNotFoundExceptions-boolean-
- contributes to
-
MMF-2044 Java analyzer detects broken authentication and access control
-
- Closed
-
- implements
-
RSPEC-5804 Allowing user enumeration is security-sensitive
- Active