Supported Fixes

A "fix" is defined as a code remediation that has been validated and tested by Mobb engineers.

All fixes must meet the following criteria:

• The fix addresses the security issue as identified by the SAST tool

• The fix should be recognized by the SAST tool (The SAST tool should recognize the finding as fixed upon re-scan)

Here are the categories of stable fixes that Mobb currently supports. If there is a category you'd like to see Mobb support that is not listed here, please email us at [e-mail].

If you'd like us to support a SAST tool that is not listed here, please tell us by submitting it here.

Since different SAST vendors often name issues differently, the issue names in parentheses are the Mobb normalized names.

List of Supported Issue Types for SonarQube

Java

• Extracting archives should not lead to zip slip vulnerabilities

• Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks

• Unused assignments should be removed

• Unused local variables should be removed

• Database queries should not be vulnerable to injection attacks

• Regular expressions should not be vulnerable to Denial of Service attacks

• I/O function calls should not be vulnerable to path injection attacks

• Public constants and fields initialized at declaration should be "static final" rather than merely "final"

• Logging should not be vulnerable to injection attacks

• Using pseudorandom number generators (PRNGs) is security-sensitive

• Creating cookies without the "secure" flag is security-sensitive

• Creating cookies without the "HttpOnly" flag is security-sensitive

• Strings and Boxed types should be compared using "equals()"

JavaScript / TypeScript

• DOM updates should not lead to cross-site scripting (XSS) attacks

• DOM updates should not lead to cross-site scripting (XSS) attacks

• Unnecessary character escapes should be removed

• Unnecessary character escapes should be removed

• Database queries should not be vulnerable to injection attacks

• Database queries should not be vulnerable to injection attacks

• NoSQL operations should not be vulnerable to injection attacks

• NoSQL operations should not be vulnerable to injection attacks

• Regular expressions should not be vulnerable to Denial of Service attacks

• Regular expressions should not be vulnerable to Denial of Service attacks

• I/O function calls should not be vulnerable to path injection attacks

• I/O function calls should not be vulnerable to path injection attacks

• DOM updates should not lead to open redirect vulnerabilities

• DOM updates should not lead to open redirect vulnerabilities

• HTTP request redirections should not be open to forging attacks

• HTTP request redirections should not be open to forging attacks

• Using pseudorandom number generators (PRNGs) is security-sensitive

• Using pseudorandom number generators (PRNGs) is security-sensitive

• Creating cookies without the "secure" flag is security-sensitive

• Hard-coded credentials are security-sensitive

• Hard-coded credentials are security-sensitive

• Using remote artifacts without integrity checks is security-sensitive

• Dynamically executing code is security-sensitive

Python

• Logging should not be vulnerable to injection attacks

• Delivering code in production with debug features activated is security-sensitive

• Disabling auto-escaping in template engines is security-sensitive

C#

• Extracting archives should not lead to zip slip vulnerabilities

• I/O function calls should not be vulnerable to path injection attacks

• Null pointers should not be dereferenced

• Logging should not be vulnerable to injection attacks

• Secure random number generators should not output predictable values

• Creating cookies without the "secure" flag is security-sensitive

• Creating cookies without the "HttpOnly" flag is security-sensitive

List of Supported Issue Types for Snyk

Java

• Arbitrary File Write via Archive Extraction (Zip Slip)

• XML External Entity (XXE) Injection

• Cross-site Scripting (XSS)

• Trust Boundary Violation

• Server-Side Request Forgery (SSRF)

• SQL Injection

• Regular expression injection

• Path Traversal

• Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

• Improper Neutralization of CRLF Sequences in HTTP Headers

• Sensitive Cookie Without 'HttpOnly' Flag

• Command Injection

JavaScript

• Cross-site Scripting (XSS)

• Privacy Leak

• Server-Side Request Forgery (SSRF)

• SQL Injection

• NoSQL Injection

• Regular Expression Denial of Service (ReDoS)

• Path Traversal

• Prototype Pollution

• Open Redirect

• Allocation of Resources Without Limits or Throttling

• Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

• Use of Hardcoded Credentials

• Denial of Service (DoS) through Nested GraphQL Queries

• Command Injection

• Indirect Command Injection via User Controlled Environment

C#

• Arbitrary File Write via Archive Extraction (Zip Slip)

• XML External Entity (XXE) Injection

• Server-Side Request Forgery (SSRF)

• SQL Injection

• Path Traversal

• Anti-forgery token validation disabled

• Log Forging

• Use of Insufficiently Random Values

• Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

• Sensitive Cookie Without 'HttpOnly' Flag

Python

• Cross Site Scripting (XSS)

• SQL Injection

• Path Traversal

• Debug Mode Enabled

• Jinja auto-escape is set to false

• Incomplete URL sanitization

List of Supported Issue Types for Checkmarx

Java

• Improper Restriction of XXE Ref

• Improper Restriction of Stored XXE Ref

• Reflected XSS All Clients

• Stored XSS

• Unchecked Input for Loop Condition

• Trust Boundary Violation in Session Variables

• Information Exposure Through an Error Message

• SSRF

• SQL Injection

• ReDoS From Regex Injection

• Race Condition Format Flaw

• Relative Path Traversal

• Absolute Path Traversal

• Password In Comment

• Declaration Of Catch For Generic Exception

• Stored Log Forging

• Log Forging

• Portability Flaw Locale Dependent Comparison

• Use of Non Cryptographic Random

• Improper Resource Shutdown or Release

• HttpOnlyCookies

• Detection of Error Condition Without Action

• Use of Wrong Operator in String Comparison

• Confusing Naming

• Command Injection

JavaScript

• Client Potential XSS

• Client DOM Stored XSS

• Client DOM XSS

• Stored XSS

• Unsafe Use Of Target blank

• Server DoS by loop

• Server DoS by Loop

• Unchecked Input For Loop Condition

• SSRF

• SQL Injection

• Client Regex Injection

• Relative Path Traversal

• Absolute Path Traversal

• Prototype Pollution

• Client Password In Comment

• Open Redirect

• Client DOM Open Redirect

• Missing HSTS Header

• Missing CSP Header

• Log Forging

• Client JQuery Deprecated Symbols

• Use of Insufficiently Random Values

• Client Insecure Randomness

• Unprotected Cookie

• Client Use Of Iframe Without Sandbox

• Use Of Hardcoded Password

• JWT Use Of Hardcoded Secret

• Hardcoded password in Connection String

• Client Hardcoded Domain

• Use of Deprecated or Obsolete Functions

• Command Injection

• Client DOM Stored Code Injection

C#

• Improper Restriction of XXE Ref

• Reflected XSS All Clients

• Stored XSS

• Value Shadowing

• Unvalidated Arguments Of Public Methods

• Deserialization of Untrusted Data

• Trust Boundary Violation in Session Variables

• Information Exposure Through an Error Message

• SSRF

• SQL Injection

• Path Traversal

• Declaration Of Catch For Generic Exception

• Missing HSTS Header

• Just One of Equals and Hash code Defined

• CSRF

• Log Forging

• Insufficient Logging of Exceptions

• Insufficient Logging of Sensitive Operations

• Use of Insufficiently Random Values

• Insecure Cookie

• Unsafe Object Binding

• Information Exposure via Headers

• Improper Resource Shutdown or Release

• Improper Exception Handling

• HttpOnlyCookies

• Heap Inspection

Python

• XSS

• SQL Injection

• Path Traversal

• Password in Comment

• Log Forging

• Improper Resource Shutdown or Release

• Debug Enabled

PL/SQL

• Default_Definer_Rights_in_Package_or_Object_Definition (Default Definer Rights in Package or Object Definition)

List of Supported Issue Types for Fortify

Java

• Path Manipulation: Zip Entry Overwrite
• XML External Entity Injection
• XML Entity Expansion Injection
• Cross-Site Scripting: Reflected
• Poor Style: Value Never Read
• Poor Logging Practice: Use of a System Output Stream
• Trust Boundary Violation
• System Information Leak: Internal
• System Information Leak
• Server-Side Request Forgery
• SQL Injection
• Denial of Service: Regular Expression
• Race Condition: Format Flaw
• Path Manipulation
• Privacy Violation
• Poor Error Handling: Empty Catch Block
• Password Management: Password in Comment
• Poor Error Handling: Overly Broad Catch
• Null Dereference
• Code Correctness: Class Does Not Implement Equivalence Method
• Poor Style: Non-final Public Static Field
• Missing Check against Null
• Log Forging
• Log Forging (debug)
• Portability Flaw: Locale Dependent Comparison
• J2EE Bad Practices: Leftover Debug Code
• Insecure Randomness
• Cookie Security: Cookie not Sent Over SSL
• Unreleased Resource: Files
• Unreleased Resource: Synchronization
• Unreleased Resource: Sockets
• Unreleased Resource: Database
• Unreleased Resource: Streams
• Unreleased Resource: Unmanaged Object
• Cookie Security: HTTPOnly not Set
• System Information Leak: HTML Comment in JSP
• Code Correctness: Erroneous String Compare
• Code Correctness: Comparison of Boxed Primitive Types
• Denial of Service: StringBuilder
• Poor Style: Confusing Naming
• Command Injection

JavaScript

• Cross-Site Scripting: DOM
• Cross-Site Scripting: Self
• System Information Leak: External
• System Information Leak: Internal
• Path Manipulation
• Password Management: Password in Comment
• Open Redirect
• Insecure Randomness
• Insecure Randomness: Hardcoded Seed
• Cookie Security: Cookie not Sent Over SSL
• Password Management: Hardcoded Password
• Credential Management: Hardcoded API Credentials
• Hardcoded Domain in HTML
• Command Injection

C#

• Path Manipulation: Zip Entry Overwrite
• XML External Entity Injection
• XML Entity Expansion Injection
• Poor Logging Practice: Use of a System Output Stream
• Trust Boundary Violation
• System Information Leak
• System Information Leak: Internal
• SQL Injection
• Path Manipulation: Base Path Overwriting
• Path Manipulation
• Password Management: Password in Comment
• Poor Error Handling: Overly Broad Catch
• Null Dereference
• Object Model Violation: Just One of Equals() and GetHashCode() Defined
• ASP.NET MVC Bad Practices: Controller Action Without AntiForgery Validation
• Log Forging
• Insecure Randomness
• Insecure Randomness: Hardcoded Seed
• Cookie Security: Session Cookie not Sent Over SSL
• Mass Assignment: Insecure Binder Configuration
• Cookie Security: HTTPOnly not Set on Application Cookie
• Header Manipulation

Python

• Path Manipulation
• Password Management: Password in Comment

XML

• Weak XML Schema: Unbounded Occurrences
• Password Management: Password in Comment

List of Supported Issue Types for CodeQL

Java

• Arbitrary file access during archive extraction (”Zip Slip”)
• Resolving XML external entity in user-controlled data
• Cross-site scripting
• Server-side request forgery
• Query built by concatenation with a possibly-untrusted string
• Query built from user-controlled sources
• Uncontrolled data used in path expression
• Log Injection
• Failure to use secure cookies
• HTTP response splitting
• Executing a command with a relative path
• Uncontrolled command line

JavaScript

• Client-side cross-site scripting
• Reflected cross-site scripting
• Useless regular-expression character escape
• Type confusion through parameter tampering
• Server-side request forgery
• Database query built from user-controlled sources
• Regular expression injection
• Inefficient regular expression
• Uncontrolled data used in path expression
• Prototype-polluting assignment
• Prototype-polluting function
• Overly permissive regular expression range
• Client-side URL redirect
• Server-side URL redirect
• Missing rate limiting
• Log injection
• Insecure randomness
• Clear text transmission of sensitive cookie
• Incomplete URL scheme check
• Incomplete URL substring sanitization
• Incomplete regular expression for hostnames
• Hard-coded credentials
• Inclusion of functionality from an untrusted source

C#

• Arbitrary file access during archive extraction (”Zip Slip”)
• Deserialization of untrusted data
• Uncontrolled data used in path expression
• Log entries created from user input
• Insecure randomness

Python

• XSS
• Uncontrolled data used in path expression
• Log Injection
• Flask app is run in debug mode
• Jinja2 templating with autoescape=False
• Incomplete URL substring sanitization

C++

• Use of dangerous function

To learn more about configuring your fix policies in Mobb, click here.