tracker issue : CFB-4130097

Related Bugs:
CF-4087973 - Similar to


Problem Description: 
Security Code Analyzer reports warnings and errors where there should be none. It also reports the same warnings/errors repeatedly.

Steps to Reproduce:
1) Create a new Coldfusion project in Blizzard. Copy the attached 'uploads' directory into it.
2) Right-click on the uploads directory and select 'Run Security Analyzer'.

Actual Result:
(a) uploadFiles.cfm (Type: Error / Security Level: High) 
Cfqueryparam has not been used. 
Your CFquery code is vulnerable to SQL injection.
Your CFquery code is vulnerable to SQL injection.
Your CFquery code is vulnerable to SQL injection.
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 

(b) uploadForm.cfm (Type: Error / Security Level: High) 
Your form is prone to CSRF attack
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 
Your code is vulnerable to XSS attack

(c) multiUpload.cfm (Type: Error / Security Level: High) 
Your code is vulnerable to XSS attack

(d) uploadFiles.cfm (Type: Warning / Security Level: Low) 
Cfqueryparam has not been used. 
Your CFquery code is vulnerable to SQL injection.
Your CFquery code is vulnerable to SQL injection.
Your CFquery code is vulnerable to SQL injection.
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 

(e) uploadForm.cfm (Type: Warning / Security Level: Low) 
Your code is vulnerable to XSS attack
Your form is prone to CSRF attack
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 

(f) uploadForm2.cfm (Type: Warning / Security Level: Low) 
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 
Your form is prone to CSRF attack

(g) uploadWithArchiving.cfm (Type: Warning / Security Level: Low) 
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 
Your code is vulnerable to file injection
Your form is prone to CSRF attack

(h) uploadWithArchiving.cfm (Type: Warning / Security Level: Low) 
Your code is vulnerable to file injection
Your form is prone to CSRF attack
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 

(i) uploadForm.cfm (Type: Warning / Security Level: Low) 
Your code is vulnerable to XSS attack
Your form is prone to CSRF attack
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 

(j) uploadForm2.cfm (Type: Warning / Security Level: Low) 
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 
Your form is prone to CSRF attack

(k) uploadWithArchiving.cfm (Type: Warning / Security Level: Low) 
Your code is vulnerable to file injection
Your form is prone to CSRF attack
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 
For upload and uploadall action of cffile tag , best practice is to use destination='#getTempDirectory()#' 

Expected Result:
1) I expected no repetition in the reports. They currently contain too many repetitions.
2) I find it ambiguous that a report of Type: Error / Security Level: High (a) is exactly the same as a report of Type: Warning / Security Level: Low (d).
3) My choice of upload directory, c:/uploads, is out of the webroot. So I expect no suggestion about using destination='#getTempDirectory()#'.
4) I do not expect that the "CFquery code is vulnerable to SQL injection". The inserted values come from the cffile struct.

Any Workarounds: 
Not applicable.

----------------------------- Additional Watson Details -----------------------------

Watson Bug ID:	4130097

External Customer Info:
External Company: (withheld for privacy)
External Customer Name: A. Bakia
External Customer Email: A.BAKIG@CHELLO.NL
External Test Config:  


Bug File Paths:
\\sjshare.corp.adobe.com\Prereleasebugfiles\ColdFusion Builder\3.1\Alpha_v31\4049701\uploads.zip

Attachments:

Comments: