Merge remote-tracking branch 'origin/alert-autofix-8' into cross-scripting

Author: velo

feign-form/src/test/java/feign/form/Server.java

@@ -28,6 +28,7 @@
 import java.io.IOException;
 import java.util.Collection;
 import java.util.List;
+import org.apache.commons.text.StringEscapeUtils;
 import lombok.val;
 import org.apache.commons.text.StringEscapeUtils;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
@@ -169,8 +170,9 @@ public ResponseEntity<String> uploadUnknownType(@RequestPart("file") MultipartFi
   @PostMapping(path = "/upload/form_data", consumes = MULTIPART_FORM_DATA_VALUE)
   public ResponseEntity<String> uploadFormData(@RequestPart("file") MultipartFile file) {
     val status = file != null ? OK : I_AM_A_TEAPOT;
+    String sanitizedFilename = StringEscapeUtils.escapeHtml4(file.getOriginalFilename());
     return ResponseEntity.status(status)
-        .body(file.getOriginalFilename() + ':' + file.getContentType());
+        .body(sanitizedFilename + ':' + file.getContentType());
   }
 
   @PostMapping(path = "/submit/url", consumes = APPLICATION_FORM_URLENCODED_VALUE)