如何解决SONAR指出的session.setAttribute（）中的信任边界冲突？

Question

I am getting this error as SONAR violation in these line . How to solve this?

HttpSession session = this.globals.getHTTPServletRequest()
                                   .getSession();                       
session.setAttribute("CONTEXT",this.globals.getHTTPServletRequest().getContextPath());
//issue is in this line 

Make sure the user is authenticated before this data is stored in the session.

This is SONAR output for that line

{

Rule

Changelog Untrusted data should not be stored in sessions Data in a web session is considered inside the "trust boundary". That is, it is assumed to be trustworthy. But storing unvetted data from an unauthenticated user violates the trust boundary, and may lead that that data being used inappropriately. This rule raises an issue when data from Cookies or HttpServletRequests is stored in a session. Noncompliant Code Example

login = request.getParameter("login");
session.setAttribute("login", login);  // Noncompliant

See MITRE, CWE-501 - Trust Boundary Violation}

Answer 1

我们必须使用“ login”作为字符串LOGIN =“ login”就是这样，它消除了SONAR违规，或者由于它是硬编码，因此您也可以使用属性文件或xml文件来传递它