Skip to content

Conversation

velo
Copy link
Member

@velo velo commented Oct 21, 2024

Fixes https://github.com/OpenFeign/feign/security/code-scanning/7

To fix the problem, we need to ensure that the user-provided content type is properly sanitized or encoded before being included in the response. The best way to fix this issue is to use a library that provides HTML encoding to prevent XSS attacks. In Java, the StringEscapeUtils class from the Apache Commons Text library can be used for this purpose.

  • General Fix: Encode the user-provided content type before including it in the response body.
  • Detailed Fix: Modify the uploadUnknownType method to encode the content type using StringEscapeUtils.escapeHtml4.
  • Files/Regions/Lines to Change: Modify lines 161-164 in feign-form/src/test/java/feign/form/Server.java.
  • Needed Imports: Add an import statement for org.apache.commons.text.StringEscapeUtils.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@velo velo merged commit d01d766 into master Oct 21, 2024
3 of 5 checks passed
@velo velo deleted the alert-autofix-7 branch October 21, 2024 15:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant