Version used:
SonarQube: 8.6.1.40680,
Scanner: 3.0 (Gradle plugin)
package com.xx.customer_mapping.filter;
import com.sysco.customer_mapping.util.Constants;
import org.slf4j.MDC;
import org.springframework.stereotype.Component;
import org.springframework.util.StringUtils;
import javax.servlet.*;
import javax.servlet.annotation.WebFilter;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.UUID;
@Component
@WebFilter("/*")
public class StatsFilter implements Filter {
private static final String CORRELATION_ID_HEADER_NAME = "Syy-Correlation-Id";
@Override
public void init(FilterConfig filterConfig) {
// empty
}
@Override
public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain) throws IOException, ServletException {
final HttpServletRequest request = (HttpServletRequest) req;
final HttpServletResponse response = (HttpServletResponse) resp;
String correlationId = request.getHeader(CORRELATION_ID_HEADER_NAME);
validate(correlationId);
MDC.put(Constants.CORRELATION_ID_LOG_VAR_NAME, correlationId);
try {
chain.doFilter(request, response);
} finally {
MDC.remove(Constants.CORRELATION_ID_LOG_VAR_NAME);
}
}
private void validate(String correlationId) throws IOException {
if (correlationId != null && !correlationIdPattern.matcher(correlationId).matches()) {
throw new IOException("Correlation ID does not match with any accepted patterns");
}
}
@Override
public void destroy() {
// empty
}
As Sonar recommends the requests which contain invalid headers should be thrown away as IO Exceptions after validating against a whitelist.
Ref: Rules explorer
However, even after validating the retrieved correlation Id, vulnerability still remains.