CleartextTransmission.qhelp

<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
<qhelp>
<overview>

<p>
Sensitive information that is transmitted without encryption may be accessible
to an attacker.
</p>

</overview>
<recommendation>

<p>
Ensure that sensitive information is always encrypted before being transmitted
over the network. In general, decrypt sensitive information only at the point
where it is necessary for it to be used in cleartext. Avoid transmitting
sensitive information when it is not necessary to.
</p>

</recommendation>
<example>

<p>
The following example shows three cases of transmitting information. In the
'BAD' case, the data transmitted is sensitive (a password) and is not encrypted
as it occurs as a URL parameter. In the 'GOOD' cases, the data is either not
sensitive, or is protected with encryption. When encryption is used, take care
to select a secure modern encryption algorithm, and put suitable key management
practices into place.
</p>

<sample src="CleartextTransmission.rs" />

</example>
<references>

<li>
  OWASP Top 10:2021:
  <a href="https://owasp.org/Top10/A02_2021-Cryptographic_Failures/">A02:2021 � Cryptographic Failures</a>.
</li>
<li>
  OWASP:
  <a href="https://cheatsheetseries.owasp.org/cheatsheets/Key_Management_Cheat_Sheet.html">Key Management Cheat Sheet</a>.
</li>

</references>
</qhelp>