java.util.Properties.load() issues OWASP Top 10 2017

Question

I have this code in java, for the use of the properties file, but when executing the secure code scan with MicroFocus FortiFy OWASP Top 10 2017, it generates issues of type "A1 Injection" and "A5 Broken Access Control" in the line that implements the method java.util.Properties.load(). I couldn't find the solution for this problem. The property file is outside the build WAR in a different directory.

My Code:

public void initPop() {
    logger.info("Cargar archivo de propiedades en memoria");
    String configProp = "config.properties";
    try {
        Properties prop = new Properties();
        InputStream inputSt = new FileInputStream("/home/ejm/properties/" + configProp);
        prop.load(inputSt);
        Map<String, String> help = new HashMap<String, String>();
        for (Enumeration<?> names = prop.keys(); names.hasMoreElements();) {
            String key = (String) names.nextElement();
            help.put(key, prop.getProperty(key));
        }
        setLstProp(help);
        inputSt.close();
        prop.clear();
    } catch (Exception ex) {
        logger.error("[getValue] Archivo " + configProp + " no encontrado : " + ex.toString());
    }
}

MicroFocus FortiFy OWASP Top 10 2017 Report:

Answer 1

This case shows a source-code which is correct and does what it should.

The check shows that your code may or may not be used to manipulate data or access portions or your software/company which would be otherwise restricted and prohibited.

Lets get into detail. A1 injection. That simply says that you load readable data from an extern file which could be manipulated. e.g. if you keep access-data in a property-file which can be read or changed. The property files have no security measure (like CRC or encoding).

A5 access. It warns you that you - if you load and use the data right away - may infect your system with a manipulated access or redirection to prohibited systems (e.g. you save a link to a hidden port which is normally only accessable via some kind of login-control).

The key to be on the safe side is "sanitizing your input-data". Control each and every pair for (a) value and range (b) accessibility of data and links (e.g. compare it with entries in databases if this user is allowed to do that) (c) store only values which are really necessary for this workstation (e.g. size of monitor, shortcuts, options, ..). If you do all that you can see it as what it is - a fair warning.