Description

Detects when an HTTP request header accepts any MIME type using wildcards (e.g. '*/*' or 'Accept: */*'). This poses a security risk as it may allow malicious content types to be processed, potentially leading to content sniffing attacks or processing of dangerous file formats.

Detection Strategy

• Check for HTTP header modification methods like setRequestProperty(), header(), setHeader(), addHeader(), or add()

• Look for header parameters that set the Accept header with wildcard values

• Report vulnerability when Accept header is configured to accept all MIME types through wildcards

Vulnerable code example

import java.net.HttpURLConnection;
import java.net.URL;

public class VulnerableHeaderExample {
    public HttpURLConnection createConnection(String url) throws Exception {
        URL target = new URL(url);
        HttpURLConnection conn = (HttpURLConnection) target.openConnection();
        ...

✅ Secure code example

import java.net.HttpURLConnection;
import java.net.URL;

public class SecureHeaderExample {
    public HttpURLConnection createConnection(String url) throws Exception {
        URL target = new URL(url);
        HttpURLConnection conn = (HttpURLConnection) target.openConnection();
        ...