File tree Expand file tree Collapse file tree 1 file changed +14
-14
lines changed
java/ql/src/Security/CWE/CWE-200 Expand file tree Collapse file tree 1 file changed +14
-14
lines changed Original file line number Diff line number Diff line change 11@ Configuration (proxyBeanMethods = false )
22public class CustomSecurityConfiguration {
33
4- @ Bean
5- public SecurityFilterChain securityFilterChain (HttpSecurity http ) throws Exception {
6- // BAD: Unauthenticated access to Spring Boot actuator endpoints is allowed
7- http .securityMatcher (EndpointRequest .toAnyEndpoint ());
8- http .authorizeHttpRequests ((requests ) -> requests .anyRequest ().permitAll ());
9- return http .build ();
10- }
4+ @ Bean
5+ public SecurityFilterChain securityFilterChain (HttpSecurity http ) throws Exception {
6+ // BAD: Unauthenticated access to Spring Boot actuator endpoints is allowed
7+ http .securityMatcher (EndpointRequest .toAnyEndpoint ());
8+ http .authorizeHttpRequests ((requests ) -> requests .anyRequest ().permitAll ());
9+ return http .build ();
10+ }
1111
1212}
1313
1414@ Configuration (proxyBeanMethods = false )
1515public class CustomSecurityConfiguration {
1616
17- @ Bean
18- public SecurityFilterChain securityFilterChain (HttpSecurity http ) throws Exception {
19- // GOOD: only users with ENDPOINT_ADMIN role are allowed to access the actuator endpoints
20- http .securityMatcher (EndpointRequest .toAnyEndpoint ());
21- http .authorizeHttpRequests ((requests ) -> requests .anyRequest ().hasRole ("ENDPOINT_ADMIN" ));
22- return http .build ();
23- }
17+ @ Bean
18+ public SecurityFilterChain securityFilterChain (HttpSecurity http ) throws Exception {
19+ // GOOD: only users with ENDPOINT_ADMIN role are allowed to access the actuator endpoints
20+ http .securityMatcher (EndpointRequest .toAnyEndpoint ());
21+ http .authorizeHttpRequests ((requests ) -> requests .anyRequest ().hasRole ("ENDPOINT_ADMIN" ));
22+ return http .build ();
23+ }
2424
2525}
You can’t perform that action at this time.
0 commit comments