Merge 'dev' branch #47
Conversation
…a-enterprise-dependencies'
Merge branch dev to dev-1.x
Merge '1.x'. branch
Welcome to Codecov 🎉Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests. ℹ️ You can also turn on project coverage checks and project coverage reporting on Pull Request comment Thanks for integrating Codecov - We've got you covered ☂️ |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| @RequestMapping(value = "/echo/{message}", method = {GET, POST}) | ||
| @Idempotent | ||
| public String echo(@PathVariable String message) { | ||
| return "[ECHO] : " + message; |
Check warning
Code scanning / CodeQL
Cross-site scripting Medium test
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 29 days ago
To fix the cross-site scripting vulnerability, we need to ensure that the user-provided input (message) is properly sanitized or encoded before being included in the response. The best way to fix this issue is to use a library that provides HTML encoding to prevent XSS attacks. In Java, the StringEscapeUtils class from the Apache Commons Text library can be used for this purpose.
- Add the Apache Commons Text library to the project dependencies if it is not already included.
- Import the
StringEscapeUtilsclass in theTestControllerclass. - Use the
StringEscapeUtils.escapeHtml4method to encode themessageparameter before including it in the response.
| @@ -23,2 +23,3 @@ | ||
| import org.springframework.web.bind.annotation.RestController; | ||
| import org.apache.commons.text.StringEscapeUtils; | ||
|
|
||
| @@ -40,3 +41,3 @@ | ||
| public String echo(@PathVariable String message) { | ||
| return "[ECHO] : " + message; | ||
| return "[ECHO] : " + StringEscapeUtils.escapeHtml4(message); | ||
| } |
| @@ -21,2 +21,7 @@ | ||
| <dependencies> | ||
| <dependency> | ||
| <groupId>org.apache.commons</groupId> | ||
| <artifactId>commons-text</artifactId> | ||
| <version>1.13.0</version> | ||
| </dependency> | ||
|
|
| Package | Version | Security advisories |
| org.apache.commons:commons-text (maven) | 1.13.0 | None |
No description provided.