JPA仓库触发CheckMarx的Improper Resource Access Authorization问题如何解决？

Let’s break down how to resolve this CheckMarx warning for your Spring Data REST repository. The "Improper Resource Access Authorization" flag means your repository method could be accessed without proper permission checks—even with exported = false set, custom query methods still pose a risk if not secured, especially if other parts of your app call them directly.

Here are actionable steps to fix this:

1. Add Method-Level Authorization with Spring Security #

The simplest and most effective fix is to use Spring Security’s annotation-based access control to restrict who can invoke your repository method.

Modify your repository to include either @PreAuthorize (checks permissions before executing the method) or @PostAuthorize (validates results after execution):

@RepositoryRestResource(path="attributes",itemResourceRel="attribute",excerptProjection=AttributeHeaderProjection.class,exported = false)
public interface AttributeHeaderDataRestRepository extends JpaRepository<AttributeHeader, String> {

    @PreAuthorize("hasRole('ROLE_ADMIN') or hasAuthority('VIEW_ATTRIBUTE_DATA')")
    @Query(" SELECT HDR FROM AttributeHeader HDR, AttributeObject OBJ " +
           "WHERE HDR.attribute=OBJ.attribute " +
           " AND OBJ.objName= ?1 ")
    List<AttributeHeader> byName(String name);
}

• hasRole('ROLE_ADMIN') ensures only users with the admin role can access this method.
• hasAuthority('VIEW_ATTRIBUTE_DATA') allows users with a specific, granular permission (you’ll need to define this in your security configuration).

2. Verify exported = false is Fully Restricting Access #

Double-check that Spring Data REST isn’t exposing the /attributes endpoint despite your setting:

• Start your app and send a request to http://your-app-url/attributes (or your custom path).
• If the endpoint is still accessible, review your global Spring Data REST configuration—there might be a setting overriding the repository-specific exported flag.

3. Implement Data-Level Authorization (Optional) #

If you need to restrict users to only view data they’re allowed to access (not just method access), use @PostAuthorize to filter results:

@PostAuthorize("returnObject.stream().allMatch(attr -> authentication.name.equals(attr.createdBy))")
List<AttributeHeader> byName(String name);

This ensures the returned AttributeHeader objects are only those created by the authenticated user.

4. Use Custom Security Interceptors (For Complex Rules) #

For more advanced access control, you can:

• Implement RepositoryRestConfigurer to add custom interceptors that check permissions before repository methods run.
• Create a Spring Filter that intercepts requests to your repository endpoints and validates user credentials before allowing access.

5. Rule Out CheckMarx False Positives #

If you’ve already implemented proper authorization but CheckMarx still flags the issue:

• Document your security controls (like @PreAuthorize annotations, security configuration, and test results showing restricted access).
• Submit this evidence to your security team to mark the finding as a false positive.

内容的提问来源于stack exchange，提问作者Rajesh Yadav