I am currently working on fixing some security problems with our webapp as reported by VeraCode. Some of these pertain to "trust boundaries", i.e, what inputs can be trusted.

In some cases, our problems appear to be due to our reading of Java system properties or of system environment variables. I can see how this could be a problem with a desktop application, where a user could set environment variables or properties and then start the application. However, in the case of a web application, where the web server startup happens under the care of a trusted administrator, it seems to me that the environment variables and system properties would be on the safe side of the trust boundary. Am I overlooking some way that the properties or variables could be misused?

  • 1
    I'm not sure about Java, but php and CGI both handle the User Agent as an environment variable, which is fully controlled by the client. – Torin42 Jan 9 '19 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.