CSRF @ /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java

[oscardatastream]

Checkmarx (SAST): CSRF
Security Issue: Read More about CSRF
Checkmarx Project: oscardatastream/slackDatastream
Repository URL: https://github.com/oscardatastream/slackDatastream
Branch: master
Scan ID: c523472e-01c3-4305-b7dd-e80238456bde

---

Method elimniar at line 72 of /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java gets a parameter from a user request from ""Documento"". This parameter value flows through the code and is eventually used to access application state altering functionality. This may enable Cross-Site Request Forgery (CSRF).

Result #1:
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ""Documento"": /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[72,43]
    2. getParameter: /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[72,42]
    3. Documento: /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[72,10]
    4. Documento: /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[74,32]
    5. update: /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[74,15]
    Review result in Checkmarx One: CSRF

Result #2:
Severity: MEDIUM
State: TO_VERIFY
Status: RECURRENT
Attack Vector:

    1. ""TipoDoc"": /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[71,41]
    2. getParameter: /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[71,40]
    3. TipoDoc: /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[71,10]
    4. TipoDoc: /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[74,23]
    5. update: /07_SpringMVC/src/main/java/com/curso/java/controladores/AlumnoControlador.java[74,15]
    Review result in Checkmarx One: CSRF