Session Attributes Never Completed
ID |
java.controller_classes_sessionattributes_call_setcomplet |
Severity |
critical |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Java |
Tags |
reliability |
Description
Reports a Spring @Controller that declares @SessionAttributes but never calls setComplete() on a SessionStatus anywhere in the class.
Rationale
@SessionAttributes stores model attributes in the HTTP session so a multi-request form can reuse them. That data is only removed once a handler method calls setComplete() on the SessionStatus passed to it; without that call, Spring has no way to know the form flow ended, and the attributes stay in the session for as long as it lives:
@Controller
@SessionAttributes("checkoutForm")
class CheckoutController {
@RequestMapping("/checkout/step1")
public String step1(String promoCode) {
return "step1";
}
// no handler ever calls setComplete() on a SessionStatus
}Remediation
Accept a SessionStatus parameter in the handler that finishes the flow and call setComplete() on it:
@Controller
@SessionAttributes("checkoutForm")
class CheckoutController {
@RequestMapping("/checkout/step1")
public String step1(String promoCode) {
return "step1";
}
@RequestMapping(value = "/checkout/finish", method = RequestMethod.POST)
public String finish(SessionStatus status) {
status.setComplete();
return "done";
}
}