SAST : Privacy.DataLeakage

[JyothiBacham]

Privacy.DataLeakage :

Source: org.apache.http.HttpEntity.getContent():InputStream via CRC32ChecksumResponseInterceptor:78

Sink: org.apache.http.protocol.HttpContext.setAttribute(String;Object):void via CRC32ChecksumResponseInterceptor:77

[JyothiBacham]

[JyothiBacham]

Hi, our SAST(AppScan) reports this vulnerability from COS jar.. can you please check if this is a valid issue and needs any change..

[JyothiBacham]

[JyothiBacham]

[IBMeric]

This code applies only to the upstream JSON protocol that COS does not support:

ibm-cos-sdk-java/ibm-cos-java-sdk-core/src/main/java/com/ibm/cloud/objectstorage/http/apache/client/impl/CRC32ChecksumResponseInterceptor.java

Line 39 in e74a8c1

 // Only Json protocol has this header, we only wrap CRC32ChecksumCalculatingInputStream in json protocol clients. 

.