Add contact feedback form with security flows and CAPTCHA (Kaptcha, CVE-2019-16335)#72
Add contact feedback form with security flows and CAPTCHA (Kaptcha, CVE-2019-16335)#72sylvain-combe-sonarsource wants to merge 2 commits intomainfrom
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| session.setAttribute("contactFeedbackCaptcha", capText); | ||
| BufferedImage bi = kaptchaProducer.createImage(capText); | ||
| response.setContentType("image/png"); | ||
| ImageIO.write(bi, "png", response.getOutputStream()); |
Check notice
Code scanning / SonarQube
Exceptions should not be thrown from servlet methods
| session.setAttribute("contactFeedbackCaptcha", capText); | ||
| BufferedImage bi = kaptchaProducer.createImage(capText); | ||
| response.setContentType("image/png"); | ||
| ImageIO.write(bi, "png", response.getOutputStream()); |
Check notice
Code scanning / SonarQube
Exceptions should not be thrown from servlet methods
| String captcha = request.getParameter("captcha"); | ||
| String captchaExpected = (String) request.getSession().getAttribute("contactFeedbackCaptcha"); | ||
| response.setContentType("text/html"); | ||
| PrintWriter out = response.getWriter(); |
Check notice
Code scanning / SonarQube
Exceptions should not be thrown from servlet methods
| String email = request.getParameter("email"); | ||
| String category = request.getParameter("category"); | ||
| response.setContentType("text/html"); | ||
| PrintWriter out = response.getWriter(); |
Check notice
Code scanning / SonarQube
Exceptions should not be thrown from servlet methods
| session.setAttribute("contactFeedbackCaptcha", capText); | ||
| BufferedImage bi = kaptchaProducer.createImage(capText); | ||
| response.setContentType("image/png"); | ||
| ImageIO.write(bi, "png", response.getOutputStream()); |
Check notice
Code scanning / SonarQube
Exceptions should not be thrown from servlet methods Low
| session.setAttribute("contactFeedbackCaptcha", capText); | ||
| BufferedImage bi = kaptchaProducer.createImage(capText); | ||
| response.setContentType("image/png"); | ||
| ImageIO.write(bi, "png", response.getOutputStream()); |
Check notice
Code scanning / SonarQube
Exceptions should not be thrown from servlet methods Low
|
1 participant
This PR adds a new contact feedback form use case to the Java security demo project, including various security flows and optional CAPTCHA validation using the Kaptcha library (CVE-2019-16335). The implementation demonstrates how static analysis can help find vulnerabilities in basic web flows, including insecure input handling and CAPTCHA integration.