Why this matters
Using user-controlled data as a parameter for thread suspension can be exploited to cause Denial of Service (DoS) attacks by exhausting available threads.
Ensure that user-controlled data is not used to suspend threads, as it can lead to Denial of Service (DoS) attacks.
Using user-controlled data as a parameter for thread suspension can be exploited to cause Denial of Service (DoS) attacks by exhausting available threads.
Side-by-side examples engineers can pattern-match during review.
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
Long time = Long.parseLong(req.getParameter("time"));
try {
Thread.sleep(time); // Noncompliant
} catch (InterruptedException e) {
resp.sendError(500);
}
}protected void compliant(HttpServletRequest req, HttpServletResponse resp) throws IOException {
Long time = Long.parseLong(req.getParameter("time"));
try {
Thread.sleep(Math.min(time, 1000));
} catch (InterruptedException e) {
resp.sendError(500);
}
}protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
Long time = Long.parseLong(req.getParameter("time"));
try {
Thread.sleep(time); // Noncompliant
} catch (InterruptedException e) {
resp.sendError(500);
}
}protected void compliant(HttpServletRequest req, HttpServletResponse resp) throws IOException {
Long time = Long.parseLong(req.getParameter("time"));
try {
Thread.sleep(Math.min(time, 1000));
} catch (InterruptedException e) {
resp.sendError(500);
}
}From the same buckets as this rule.