Use of less trusted source

ID

scala.endpoint.scala_endpoint_rule_jaxrsendpoint

Severity

low

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Endpoint

Language

Scala

Description

This method is part of a REST Web Service (JSR311). The security of this web service should be analyzed. For example: - Authentication, if enforced, should be tested. - Access control, if enforced, should be tested. - The inputs should be tracked for potential vulnerabilities. - The communication should ideally be over SSL. - If the service supports writes (e.g., via POST), its vulnerability to CSRF should be investigated.

Rationale

This method is part of a REST Web Service (JSR311). The security of this web service should be analyzed. For example: - Authentication, if enforced, should be tested. - Access control, if enforced, should be tested. - The inputs should be tracked for potential vulnerabilities. - The communication should ideally be over SSL. - If the service supports writes (e.g., via POST), its vulnerability to CSRF should be investigated.

The following code illustrates a vulnerable pattern detected by this rule:

class OrderResource {
  def passthrough(value: String) = value

  @Path("/summary")
  // VULNERABLE: Use of less trusted source
  def summary(reference: String) = "Order " + reference

  @Path("/detail")

  @Path("/status")

  @Path("/receipt")

  @Path("/label")

  // Without @Path the method is not an entry point, so its parameter is not a source.
  def internalLabel(reference: String): String = {
    return "Order " + reference
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved