Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 7: Cross-site scripting #2613

Merged
merged 1 commit into from
Oct 21, 2024
Merged

Conversation

velo
Copy link
Member

@velo velo commented Oct 21, 2024

Fixes https://github.com/OpenFeign/feign/security/code-scanning/7

To fix the problem, we need to ensure that the user-provided content type is properly sanitized or encoded before being included in the response. The best way to fix this issue is to use a library that provides HTML encoding to prevent XSS attacks. In Java, the StringEscapeUtils class from the Apache Commons Text library can be used for this purpose.

  • General Fix: Encode the user-provided content type before including it in the response body.
  • Detailed Fix: Modify the uploadUnknownType method to encode the content type using StringEscapeUtils.escapeHtml4.
  • Files/Regions/Lines to Change: Modify lines 161-164 in feign-form/src/test/java/feign/form/Server.java.
  • Needed Imports: Add an import statement for org.apache.commons.text.StringEscapeUtils.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@velo velo merged commit d01d766 into master Oct 21, 2024
3 of 5 checks passed
@velo velo deleted the alert-autofix-7 branch October 21, 2024 15:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant