Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
ID |
scala.inject.scala_inject_rule_httpparameterpollution |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Inject |
Language |
Scala |
Description
Concatenating unvalidated user input into a URL can allow an attacker to override the value of a request parameter. Attacker may be able to override existing parameter values, inject a new parameter or exploit variables out of a direct reach. HTTP Parameter Pollution (HPP) attacks consist of injecting encoded query string delimiters into other existing parameters. If a web application does not properly sanitize the user input, a malicious user may compromise the logic of the application to perform either client-side or server-side attacks.
Rationale
Concatenating unvalidated user input into a URL can allow an attacker to override the value of a request parameter. Attacker may be able to override existing parameter values, inject a new parameter or exploit variables out of a direct reach. HTTP Parameter Pollution (HPP) attacks consist of injecting encoded query string delimiters into other existing parameters. If a web application does not properly sanitize the user input, a malicious user may compromise the logic of the application to perform either client-side or server-side attacks.
The following code illustrates a vulnerable pattern detected by this rule:
// An unencoded value can carry its own `&name=value`, adding parameters the caller chose.
class LookupServlet extends HttpServlet {
override def doGet(request: HttpServletRequest, response: HttpServletResponse): Unit = {
try {
val sku = request.getParameter("sku")
val encoded = new HttpGet("https://catalogue.internal?sku=" + URLEncoder.encode(sku))
// VULNERABLE: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
val unencoded = new HttpGet("https://catalogue.internal?sku=" + sku)
val escaped = new HttpGet("https://catalogue.internal?sku=" + urlPathSegmentEscaper().escape(sku))
// VULNERABLE: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
val legacy = new GetMethod("https://catalogue.internal?sku=" + sku)
// VULNERABLE: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
legacy.setQueryString("sku=" + sku)
} catch {
case e: Exception =>
System.out.println(e)
}
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A05 : Injection.