problem-based-packs.insecure-transport.java-stdlib.unirest-http-request.unirest-http-request

profile photo of returntocorpreturntocorp
Author
6,272
Download Count*
LGPL Commons Clause
License

Checks for requests sent via Unirest to http:// URLS. This is dangerous because the server is attempting to connect to a website that does not encrypt traffic with TLS. Instead, send requests only to https:// URLS.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: unirest-http-request
    message: Checks for requests sent via Unirest to http:// URLS. This is dangerous
      because the server is attempting to connect to a website that does not
      encrypt traffic with TLS. Instead, send requests only to https:// URLS.
    severity: WARNING
    metadata:
      likelihood: MEDIUM
      impact: MEDIUM
      confidence: MEDIUM
      category: security
      cwe: "CWE-319: Cleartext Transmission of Sensitive Information"
      owasp: A03:2017 - Sensitive Data Exposure
      references:
        - https://kong.github.io/unirest-java/#requests
      subcategory:
        - vuln
      technology:
        - unirest
      vulnerability: Insecure Transport
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    languages:
      - java
    fix-regex:
      regex: "[Hh][Tt][Tt][Pp]://"
      replacement: https://
      count: 1
    pattern-either:
      - pattern: |
          Unirest.get("=~/[hH][tT][tT][pP]://.*/")
      - pattern: |
          Unirest.post("=~/[hH][tT][tT][pP]://.*/")

Examples

unirest-http-request.java

class Bad {
    public void bad1() {
        // ruleid: unirest-http-request
        HttpResponse<JsonNode> response = Unirest.post("http://httpbin.org/post")
            .header("accept", "application/json")
            .queryString("apiKey", "123")
            .field("parameter", "value")
            .field("firstname", "Gary")
            .asJson();
    }

    public void bad2() {
        // ruleid: unirest-http-request
        Unirest.get("http://httpbin.org")
            queryString("fruit", "apple")
            .queryString("droid", "R2D2")
            .asString();
    }
}

class Ok {
    public void ok1() {
        // ok: unirest-http-request
        HttpResponse<JsonNode> response = Unirest.post("https://httpbin.org/post")
            .header("accept", "application/json")
            .queryString("apiKey", "123")
            .field("parameter", "value")
            .field("firstname", "Gary")
            .asJson();
    }

    public void ok2() {
        // ok: unirest-http-request
        Unirest.get("https://httpbin.org")
            queryString("fruit", "apple")
            .queryString("droid", "R2D2")
            .asString();
    }
}