Scan Server

Code Insight 6.14.2 SP2

The Scan Server has the following security features.

scanEngine.properties Validation

If any of these properties are blank (or set incorrectly), then this servlet will not run:

•

uploadToScanEnableScanner must be “true”.

•

uploadToScanUploadDirectory must be a string.

•

This directory must the same as (or a child directory of) the directory defined for the serverFileSystemRoot property, which is also set in the scanEngine.properties file.

Additional Security Features

Additional security features include the following:

•

Scan Server only accepts HTTP Post submissions, never HTTP Get submissions.

•

All uploaded/extracted files are set to read-only and non-executable.

•

All extracted directories are set to read-only and executable.

•

On Linux systems, directories must be executable to be read.

•

The Upload to Scan process does not create symbolic links of any kind.

•

The process checks every file as it is extracted and written to determine whether the file is a symbolic link. If the file is a symbolic link, it is deleted and a line is written to the Scan Server’s log file:

[INFO] Upload to Scan (scanner): Successfully deleted symbolic link: " + filePath

where filePath is the full path to the symbolic link that was deleted. This process is identical for all uploaded files, whether the user uploads one file or an entire archive.

•

Extracted files will only be written into the uploaded file's parent directory or a child directory of the uploaded file's parent directory. This keeps the upload from writing any content to other locations on the file system (e.g., a malicious attempt to upload an app to the Tomcat webapps directory or an accidental attempt to overwrite the '/' directory).