Skip to content

Revert "removed undocumented route that contained xss" #270

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
VanJackal wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Revert "removed undocumented route that contained xss" #270

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,11 @@

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

import java.security.Principal;

/**
* CritterSpringApplication.java
Expand All @@ -20,5 +23,10 @@ public class CritterSpringApplication {
public static void main(String[] args) {
SpringApplication.run(CritterSpringApplication.class, args);
}

@GetMapping("/ping")
public String ping(Principal principal, @RequestParam(value = "reply", defaultValue = "pong") String reply) {
return reply + "\n" + principal.getName();

Check warning

Code scanning / CodeQL

Cross-site scripting

Cross-site scripting vulnerability due to a [user-provided value](1).

Copilot Autofix

AI almost 2 years ago

To fix the cross-site scripting vulnerability, we need to ensure that the user-provided input (reply parameter) is properly sanitized or encoded before being included in the response. The best way to achieve this is by using a library that provides HTML encoding functionality to escape any potentially harmful characters.

We will use the StringEscapeUtils class from the Apache Commons Text library to encode the reply parameter. This will ensure that any special characters in the user input are properly escaped, preventing XSS attacks.

Suggested changeset 2
critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java b/critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java
--- a/critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java
+++ b/critterSpring/src/main/java/com/combatcritters/critterspring/CritterSpringApplication.java
@@ -7,2 +7,3 @@
 import org.springframework.web.bind.annotation.RestController;
+import org.apache.commons.text.StringEscapeUtils;
 
@@ -28,3 +29,4 @@
 	public String ping(Principal principal, @RequestParam(value = "reply", defaultValue = "pong") String reply) {
-		return reply + "\n" + principal.getName();
+		String encodedReply = StringEscapeUtils.escapeHtml4(reply);
+		return encodedReply + "\n" + principal.getName();
 	}
EOF
@@ -7,2 +7,3 @@
import org.springframework.web.bind.annotation.RestController;
import org.apache.commons.text.StringEscapeUtils;

@@ -28,3 +29,4 @@
public String ping(Principal principal, @RequestParam(value = "reply", defaultValue = "pong") String reply) {
return reply + "\n" + principal.getName();
String encodedReply = StringEscapeUtils.escapeHtml4(reply);
return encodedReply + "\n" + principal.getName();
}
critterSpring/build.gradle
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/critterSpring/build.gradle b/critterSpring/build.gradle
--- a/critterSpring/build.gradle
+++ b/critterSpring/build.gradle
@@ -41,2 +41,3 @@
 dependencies {
+	implementation 'org.apache.commons:commons-text:1.12.0'
 	implementation project(':app')
EOF
@@ -41,2 +41,3 @@
dependencies {
implementation 'org.apache.commons:commons-text:1.12.0'
implementation project(':app')
This fix introduces these dependencies
Package Version Security advisories
org.apache.commons:commons-text (maven) 1.12.0 None
Copilot is powered by AI and may make mistakes. Always verify output.
}

}