Skip to content

Revert "removed undocumented route that contained xss" - #270

Open
VanJackal wants to merge 1 commit into
mainfrom
revert-263-262-fix-code-scanning-alert-cross-site-scripting
Open

Revert "removed undocumented route that contained xss"#270
VanJackal wants to merge 1 commit into
mainfrom
revert-263-262-fix-code-scanning-alert-cross-site-scripting

Conversation

@VanJackal

@VanJackal VanJackal commented Dec 12, 2024

Copy link
Copy Markdown
Contributor

Reverts #263

github-advanced-security[bot]
github-advanced-security AI found potential problems Dec 12, 2024
View reviewed changes
Comment thread critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java

@GetMapping("/ping")
public String ping(Principal principal, @RequestParam(value = "reply", defaultValue = "pong") String reply) {
return reply + "\n" + principal.getName();

Check warning

Code scanning / CodeQL

Cross-site scripting

Cross-site scripting vulnerability due to a [user-provided value](1).

Copilot Autofix

AI almost 2 years ago

To fix the cross-site scripting vulnerability, we need to ensure that the user-provided input (reply parameter) is properly sanitized or encoded before being included in the response. The best way to achieve this is by using a library that provides HTML encoding functionality to escape any potentially harmful characters.

We will use the StringEscapeUtils class from the Apache Commons Text library to encode the reply parameter. This will ensure that any special characters in the user input are properly escaped, preventing XSS attacks.

Suggested changeset 2
critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java b/critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java
--- a/critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java
+++ b/critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java
@@ -7,2 +7,3 @@
 import org.springframework.web.bind.annotation.RestController;
+import org.apache.commons.text.StringEscapeUtils;
 
@@ -28,3 +29,4 @@
 	public String ping(Principal principal, @RequestParam(value = "reply", defaultValue = "pong") String reply) {
-		return reply + "\n" + principal.getName();
+		String encodedReply = StringEscapeUtils.escapeHtml4(reply);
+		return encodedReply + "\n" + principal.getName();
 	}
EOF
@@ -7,2 +7,3 @@
import org.springframework.web.bind.annotation.RestController;
import org.apache.commons.text.StringEscapeUtils;

@@ -28,3 +29,4 @@
public String ping(Principal principal, @RequestParam(value = "reply", defaultValue = "pong") String reply) {
return reply + "\n" + principal.getName();
String encodedReply = StringEscapeUtils.escapeHtml4(reply);
return encodedReply + "\n" + principal.getName();
}
critterSpring/build.gradle
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/critterSpring/build.gradle b/critterSpring/build.gradle
--- a/critterSpring/build.gradle
+++ b/critterSpring/build.gradle
@@ -41,2 +41,3 @@
 dependencies {
+	implementation 'org.apache.commons:commons-text:1.12.0'
 	implementation project(':app')
EOF
@@ -41,2 +41,3 @@
dependencies {
implementation 'org.apache.commons:commons-text:1.12.0'
implementation project(':app')
This fix introduces these dependencies
Package Version Security advisories
org.apache.commons:commons-text (maven) 1.12.0 None
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@whatdoes3plus1equalsto whatdoes3plus1equalsto whatdoes3plus1equalsto approved these changes
@kivine99 kivine99 kivine99 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@VanJackal @github-advanced-security @whatdoes3plus1equalsto @kivine99