<commit_before># This file defines the default (English) variants of all of the internationalised messages
sessionfixation.name=Session Fixation
sessionfixation.desc=Session Fixation may be possible. If this issue occurs with a login URL (where the user authenticates themselves to the application), then the url may be given by an attacker, along with a fixed session id, to a victim, in order to later assume the identity of the victim using the given session id. If the issue occurs with a non-login page, the url and fixed session id may only be used by an attacker to track an unauthenticated user's actions. If the vulnerability occurs on a cookie field or a form field (POST parameter) rather than on a url (GET) parameter, then some other vulnerability may also be required in order to set the cookie field on the victim's browser, to allow the vulnerability to be exploited.
sessionfixation.soln=1) Prevent the attacker from gaining a session id by enforcing strict session ids, and by only allocating session ids upon successful authentication to the application.\n2) The server should always create a new session id upon authentication, regardless of whether a session is already in place.\n3) Bind the session id to some identificable client attribute combination, such as IP address, SSL client certificate.\n4) Sessions, when destroyed, must be destroyed on the server, as well as on the client.\n5) Implement a logout mechanism which will destroy all previous sessions for the client.\n6) Implement absolute session timeouts.\n7)Switch from a url based to a cookie or form based session id implementation, as the latter typically require additional vulnerabilities, in order to be exploitable by an attacker\n
sessionfixation.refs=The OWASP guide at https://www.owasp.org/index.php/Session_fixation\nhttp://www.acros.si/papers/session_fixation.pdf\nhttp://www.technicalinfo.net/papers/WebBasedSessionManagement.html
sessionfixation.alert.cookie.extrainfo=Cookie set in response when cookie field [{0}] is set to NULL: [{1}]\nCookie set in response with borrowed (valid) cookie value in request [{1}] : [{2}]
sessionfixation.alert.url.extrainfo=A likely session value has appeared in URLs in the HTML output when URL parameter/pseudo URL parameter [{0}] is set to NULL: [{1}]\nWhen this 'borrowed' session [{1}] is used in a subsequent request for this url, a new session is not created: [{2}]
sessionfixation.alert.attack={0} field: {1}
sessionfixation.alert.logmessage=A likely Session Fixation Vulnerability has been found with [{0}] url [{1}] on {2} field: {3}<commit_msg>- Added sections for the "exposed session id" alert.<commit_after># This file defines the default (English) variants of all of the internationalised messages
sessionfixation.name=Session Fixation
sessionfixation.desc=Session Fixation may be possible. If this issue occurs with a login URL (where the user authenticates themselves to the application), then the url may be given by an attacker, along with a fixed session id, to a victim, in order to later assume the identity of the victim using the given session id. If the issue occurs with a non-login page, the url and fixed session id may only be used by an attacker to track an unauthenticated user's actions. If the vulnerability occurs on a cookie field or a form field (POST parameter) rather than on a url (GET) parameter, then some other vulnerability may also be required in order to set the cookie field on the victim's browser, to allow the vulnerability to be exploited.
sessionfixation.soln=1) Prevent the attacker from gaining a session id by enforcing strict session ids, and by only allocating session ids upon successful authentication to the application.\n2) The server should always create a new session id upon authentication, regardless of whether a session is already in place.\n3) Bind the session id to some identificable client attribute combination, such as IP address, SSL client certificate.\n4) Sessions, when destroyed, must be destroyed on the server, as well as on the client.\n5) Implement a logout mechanism which will destroy all previous sessions for the client.\n6) Implement absolute session timeouts.\n7)Switch from a url based to a cookie or form based session id implementation, as the latter typically require additional vulnerabilities, in order to be exploitable by an attacker\n
sessionfixation.refs=https://www.owasp.org/index.php/Top_10_2010-A3-Broken_Authentication_and_Session_Management\nhttps://www.owasp.org/index.php/Session_fixation\nhttp://www.acros.si/papers/session_fixation.pdf\nhttp://www.technicalinfo.net/papers/WebBasedSessionManagement.html
sessionfixation.alert.cookie.extrainfo=Cookie set in response when cookie field [{0}] is set to NULL: [{1}]\nCookie set in response with borrowed (valid) cookie value in request [{1}] : [{2}]
sessionfixation.alert.url.extrainfo=A likely session value has appeared in URLs in the HTML output when URL parameter/pseudo URL parameter [{0}] is set to NULL: [{1}]\nWhen this 'borrowed' session [{1}] is used in a subsequent request for this url, a new session is not created.
sessionfixation.alert.attack={0} field: [{1}]
sessionfixation.alert.logmessage=A likely Session Fixation Vulnerability has been found with [{0}] url [{1}] on {2} field: [{3}]
sessionidexposedinurl.name=Exposed Session Id
sessionidexposedinurl.desc=A session id is exposed in the url. By sharing such a website url (containing the session id), a naiive user may be inadvertently granting access to their data, compromising its confidentiality, integrity, and availability.  Urls containing the session identifier also appear in web browser bookmarks, web server log files, and proxy server log files. 
sessionidexposedinurl.soln=Use a more secure session management implementation, such as one that uses session cookies, which are not as easily shared inadvertently, and which do not typically appear in server log files or web browser bookmarks.
#these refs cannot be referenced, but we leave it here in the hope that it can be in the future..
sessionidexposedinurl.refs=https://www.owasp.org/index.php/Top_10_2010-A3-Broken_Authentication_and_Session_Management
sessionidexposedinurl.alert.extrainfo={0} field [{1}] contains an exposed session identifier [{2}] 
sessionidexposedinurl.alert.attack={0} field: [{1}]
sessionidexposedinurl.alert.logmessage=An exposed session identifier has been found at [{0}] url [{1}] on {2} field: [{3}]
{'fraction_non_alphanumeric': 0.06554074992252866, 'fraction_numerical': 0.009916330957545709, 'mean_word_length': 5.328431372549019, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 4, 'lorem ipsum': 0, 'www.': 8, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6817362', 'n_tokens_mistral': 1652, 'n_tokens_neox': 1576, 'n_words': 862}