# Cwe 501 Trust Boundary Violation

> Use this skill when you need to remediate CWE-501 (Trust Boundary Violation) vulnerabilities in Java code. Triggers on SAST findings, security reviews, or when fixing trust boundary violation issues.

- Skill: `developerscoffee/cwe-501-trust-boundary-violation` (Agent Skill)
- Install (CLI): `npx skillmds@latest add developerscoffee/cwe-501-trust-boundary-violation`
- Raw SKILL.md: https://api.skillmd.com/api/skills/developerscoffee/cwe-501-trust-boundary-violation/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: DevelopersCoffee (https://skillmd.com/u/developerscoffee)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/developerscoffee/cwe-501-trust-boundary-violation

---


# CWE-501 Trust Boundary Violation

## Description

Trust Boundary Violation

Reference:
https://cwe.mitre.org/data/definitions/501.html


**OWASP Category**: A04:2021 – Insecure Design


---

## Vulnerable Pattern


### ❌ Example 1: Vulnerable Pattern

```java
// VULNERABLE: Storing unvalidated data in session
String role = request.getParameter("role");
session.setAttribute("userRole", role);  // Attacker can set role=admin!

// VULNERABLE: User object stored without validation
User user = deserializeUser(request.getInputStream());
session.setAttribute("currentUser", user);  // Unvalidated!
```


**Why it's vulnerable:** This pattern is vulnerable to Trust Boundary Violation




---

## Deterministic Fix


### ✅ Secure Implementation: Secure Implementation

```java
// SECURE: Validate before storing in session
String role = request.getParameter("role");

// Validate against allowed values
Set<String> allowedRoles = Set.of("user", "viewer", "editor");
if (!allowedRoles.contains(role)) {
    throw new SecurityException("Invalid role: " + role);
}
session.setAttribute("userRole", role);

// SECURE: Only store data retrieved from trusted source
// Don't trust client-provided user data - fetch from database
String userId = request.getParameter("userId");
User user = userRepository.findById(userId)
    .orElseThrow(() -> new AuthenticationException("User not found"));

// Verify user is authenticated before storing
if (!isAuthenticated(user, request)) {
    throw new AuthenticationException("Not authenticated");
}
session.setAttribute("currentUser", user);
```


**Why it's secure:** Implements proper protection against Trust Boundary Violation




---

## Detection Pattern

Look for these patterns in your codebase:


```bash
# Find session.setAttribute with user input
grep -rn "session.setAttribute" --include="*.java" -B5 | grep "getParameter"
```



---

## Remediation Steps


1. Never store unvalidated user input in session

2. Validate data against allowlist before trusting

3. Fetch user data from database, not from client

4. Authenticate/authorize before promoting to session


---

## Key Imports

```java

import javax.servlet.http.HttpSession;

```

---

## Verification

After remediation:


- Run SAST scanner to confirm vulnerability is resolved

- Review all instances of the vulnerable pattern

- Add unit tests that verify the secure implementation

- Check for similar patterns in related code


---

## Trigger Examples

```
Fix CWE-501 vulnerability
Resolve Trust Boundary Violation issue
Secure this Java code against trust boundary violation
SAST reports CWE-501
```

---

## Common Vulnerable Locations

| Layer | Files | Patterns |
|-------|-------|----------|

| Controller | `*Controller.java` | User input handling |

| Service | `*Service.java` | Business logic |

| Repository | `*Repository.java` | Data access |


---

## References


- [CWE-501: Trust Boundary Violation](https://cwe.mitre.org/data/definitions/501.html)


---

**Source**: Generated by [Java CWE Security Skills Generator](https://github.com/DevelopersCoffee/java-cwe-security-skills)
**Last Updated**: 2026-03-07