28 private SessionService sessService;
29 //for pbkdf later
30
31 public RandomNumberGenerator random; 32
33 public char[] symbols;
34 30
31 public RandomNumberGenerator random;
32
33 public char[] symbols; 34
35 public char[] buf;
36 32
33 public char[] symbols;
34
35 public char[] buf; 36
37 public String nextString() {
38 for (int idx = 0; idx < buf.length; ++idx) 20
21 @Autowired
22 private JdbcTemplate jdbcTemplate;
23 private EntityManager manager; 24
25 @Autowired
26 SecuritySettings secSetting;14public class SessionRepository {
15 @Autowired
16 private JdbcTemplate jdbcTemplate;
17 private EntityManager manager;18 public List<Session> findByID(int userID){
19 try {
20 List <Session> result= jdbcTemplate.query("SELECT * FROM session WHERE userID=?",Spring components should not introduced unmanaged state variables (fields not managed by Spring).
Spring components such as @Component, @Controller, @Service, and @Repository are supposed to be singletons by default.
This means that no more than one instance of such classes must exist in an application. Furthermore, the state of these classes
is managed by the Spring container.
Non-injected properties in such classes could indicate an attempt to manage state. This introduces the risk of exposing data to clients that
shouldn't have access to such data. For example, one might accidentally allow User1 to access User2's session if such patterns are followed throughout the source code.
Bad Practice
@Component
public class MyComponent {
private Service someService;
}
Recommended
Consider injecting these fields manually.
@Component
public class MyComponent {
@Autowired
private final Service someService;
}
Alternatively, use constructor injection to inject dependencies.
@Component
public class MyComponent {
private final Service someService;
@Autowired
public MyComponent(Service someService) {
this.someService = someService;
}
}
References
- CWE-488 - Exposure of Data Element to Wrong Session
- OWASP Top Ten 2021 - Category A01 - Broken Access Control
- OWASP Top Ten 2021 - Category A04 - Insecure Design
- Spring Blog - Setter vs Construction Injection