Status/Resolution/Reason: Closed/Won't Fix/
Reporter/Name(from Bugbase): Travis Walters / Travis Walters (Travis Walters)
Created: 03/09/2016
Components: Security
Versions: 2016
Failure Type: Unspecified
Found In Build/Fixed In Build: Alpha_v12 /
Priority/Frequency: Trivial / Unknown
Locale/System: English / Win All
Vote Count: 1
While most security risks -should- be taken care of during development, it is possible that some may get overlooked even with the new Security Analyzer. Perhaps the programmer is just lazy and just wants to do enough to get by - who knows?
Anyway, how about we have an option to raise a new event in the Application.cfc file called OnSecurityBreach that could handle attacks of various types?
For example, if somebody is passing in a URL variable which contains some content like DELETE, INSERT INTO, UPDATE and that URL variable is found within a CFQUERY tag without using CFQUERYPARAM, that is a pretty obvious security threat. It would be extremely nice if we could setup an event handler in the Application.cfc file to handle these circumstances.
The OnSecurityBreach should have some information passed into it such as the type of security error, some sort of message, etc.
Feel free to expand on this idea if you'd like.
----------------------------- Additional Watson Details -----------------------------
Watson Bug ID: 4126712
External Customer Info:
External Company:
External Customer Name: Travis Walters
External Customer Email: TWALTERS84@HOTMAIL.COM
External Test Config:Attachments:
Comments: