github-advanced-security[bot] commented on code in PR #1033:
URL: https://github.com/apache/myfaces/pull/1033#discussion_r3674905172
##########
impl/src/main/java/org/apache/myfaces/context/servlet/ServletExternalContextImpl.java:
##########
@@ -1122,4 +1126,108 @@
}
return _currentFacesContext;
}
+
+ /**
+ * Coalesces the many small render-time writes into few large writes to
the container writer, like a
+ * {@link java.io.BufferedWriter} does, but additionally allows the
buffered chars to be discarded again by
+ * {@link #reset()} and resolves the container writer per drain instead of
holding on to it.
+ * <p>
+ * Both are required because a {@link
jakarta.faces.context.ResponseWriter} keeps writing into the very instance it
+ * obtained from {@link
jakarta.faces.context.ExternalContext#getResponseOutputWriter()}. Replacing
this instance on
+ * {@link jakarta.faces.context.ExternalContext#responseReset()} would
therefore silently route everything rendered afterwards, such as an
+ * error page, into a buffer which is never drained.
+ */
+ static final class ResettableBufferedWriter extends Writer
+ {
+ private static final int BUFFER_SIZE = 8192;
+
+ private final ServletResponse response;
+ private final char[] buffer = new char[BUFFER_SIZE];
+ private int count;
+
+ ResettableBufferedWriter(ServletResponse response)
+ {
+ this.response = response;
+ }
+
+ @Override
+ public void write(int c) throws IOException
+ {
+ if (count >= BUFFER_SIZE)
+ {
+ drain();
+ }
+ buffer[count++] = (char) c;
+ }
+
+ @Override
+ public void write(char[] chars, int offset, int length) throws
IOException
+ {
+ if (length >= BUFFER_SIZE)
+ {
+ drain();
+ response.getWriter().write(chars, offset, length);
+ return;
+ }
+ if (length > BUFFER_SIZE - count)
+ {
+ drain();
+ }
+ System.arraycopy(chars, offset, buffer, count, length);
+ count += length;
+ }
+
+ @Override
+ public void write(String string, int offset, int length) throws
IOException
+ {
+ if (length >= BUFFER_SIZE)
+ {
+ drain();
+ response.getWriter().write(string, offset, length);
Review Comment:
## CodeQL / Cross-site scripting
Cross-site scripting vulnerability due to a [user-provided value](1).
Cross-site scripting vulnerability due to a [user-provided value](2).
Cross-site scripting vulnerability due to a [user-provided value](3).
Cross-site scripting vulnerability due to a [user-provided value](4).
Cross-site scripting vulnerability due to a [user-provided value](5).
Cross-site scripting vulnerability due to a [user-provided value](6).
Cross-site scripting vulnerability due to a [user-provided value](7).
Cross-site scripting vulnerability due to a [user-provided value](8).
Cross-site scripting vulnerability due to a [user-provided value](9).
Cross-site scripting vulnerability due to a [user-provided value](10).
Cross-site scripting vulnerability due to a [user-provided value](11).
Cross-site scripting vulnerability due to a [user-provided value](12).
Cross-site scripting vulnerability due to a [user-provided value](13).
Cross-site scripting vulnerability due to a [user-provided value](14).
Cross-site scripting vulnerability due to a [user-provided value](15).
Cross-site scripting vulnerability due to a [user-provided value](16).
Cross-site scripting vulnerability due to a [user-provided value](17).
Cross-site scripting vulnerability due to a [user-provided value](18).
Cross-site scripting vulnerability due to a [user-provided value](19).
Cross-site scripting vulnerability due to a [user-provided value](20).
Cross-site scripting vulnerability due to a [user-provided value](21).
Cross-site scripting vulnerability due to a [user-provided value](22).
Cross-site scripting vulnerability due to a [user-provided value](23).
Cross-site scripting vulnerability due to a [user-provided value](24).
Cross-site scripting vulnerability due to a [user-provided value](25).
Cross-site scripting vulnerability due to a [user-provided value](26).
Cross-site scripting vulnerability due to a [user-provided value](27).
[Show more
details](https://github.com/apache/myfaces/security/code-scanning/118)
##########
impl/src/main/java/org/apache/myfaces/context/servlet/ServletExternalContextImpl.java:
##########
@@ -1122,4 +1126,108 @@
}
return _currentFacesContext;
}
+
+ /**
+ * Coalesces the many small render-time writes into few large writes to
the container writer, like a
+ * {@link java.io.BufferedWriter} does, but additionally allows the
buffered chars to be discarded again by
+ * {@link #reset()} and resolves the container writer per drain instead of
holding on to it.
+ * <p>
+ * Both are required because a {@link
jakarta.faces.context.ResponseWriter} keeps writing into the very instance it
+ * obtained from {@link
jakarta.faces.context.ExternalContext#getResponseOutputWriter()}. Replacing
this instance on
+ * {@link jakarta.faces.context.ExternalContext#responseReset()} would
therefore silently route everything rendered afterwards, such as an
+ * error page, into a buffer which is never drained.
+ */
+ static final class ResettableBufferedWriter extends Writer
+ {
+ private static final int BUFFER_SIZE = 8192;
+
+ private final ServletResponse response;
+ private final char[] buffer = new char[BUFFER_SIZE];
+ private int count;
+
+ ResettableBufferedWriter(ServletResponse response)
+ {
+ this.response = response;
+ }
+
+ @Override
+ public void write(int c) throws IOException
+ {
+ if (count >= BUFFER_SIZE)
+ {
+ drain();
+ }
+ buffer[count++] = (char) c;
+ }
+
+ @Override
+ public void write(char[] chars, int offset, int length) throws
IOException
+ {
+ if (length >= BUFFER_SIZE)
+ {
+ drain();
+ response.getWriter().write(chars, offset, length);
+ return;
+ }
+ if (length > BUFFER_SIZE - count)
+ {
+ drain();
+ }
+ System.arraycopy(chars, offset, buffer, count, length);
+ count += length;
+ }
+
+ @Override
+ public void write(String string, int offset, int length) throws
IOException
+ {
+ if (length >= BUFFER_SIZE)
+ {
+ drain();
+ response.getWriter().write(string, offset, length);
Review Comment:
## CodeQL / Information exposure through a stack trace
[Error information](1) can be exposed to an external user.
[Show more
details](https://github.com/apache/myfaces/security/code-scanning/119)
##########
impl/src/main/java/org/apache/myfaces/context/servlet/ServletExternalContextImpl.java:
##########
@@ -1122,4 +1126,108 @@
}
return _currentFacesContext;
}
+
+ /**
+ * Coalesces the many small render-time writes into few large writes to
the container writer, like a
+ * {@link java.io.BufferedWriter} does, but additionally allows the
buffered chars to be discarded again by
+ * {@link #reset()} and resolves the container writer per drain instead of
holding on to it.
+ * <p>
+ * Both are required because a {@link
jakarta.faces.context.ResponseWriter} keeps writing into the very instance it
+ * obtained from {@link
jakarta.faces.context.ExternalContext#getResponseOutputWriter()}. Replacing
this instance on
+ * {@link jakarta.faces.context.ExternalContext#responseReset()} would
therefore silently route everything rendered afterwards, such as an
+ * error page, into a buffer which is never drained.
+ */
+ static final class ResettableBufferedWriter extends Writer
+ {
+ private static final int BUFFER_SIZE = 8192;
+
+ private final ServletResponse response;
+ private final char[] buffer = new char[BUFFER_SIZE];
+ private int count;
+
+ ResettableBufferedWriter(ServletResponse response)
+ {
+ this.response = response;
+ }
+
+ @Override
+ public void write(int c) throws IOException
+ {
+ if (count >= BUFFER_SIZE)
+ {
+ drain();
+ }
+ buffer[count++] = (char) c;
+ }
+
+ @Override
+ public void write(char[] chars, int offset, int length) throws
IOException
+ {
+ if (length >= BUFFER_SIZE)
+ {
+ drain();
+ response.getWriter().write(chars, offset, length);
+ return;
+ }
+ if (length > BUFFER_SIZE - count)
+ {
+ drain();
+ }
+ System.arraycopy(chars, offset, buffer, count, length);
+ count += length;
+ }
+
+ @Override
+ public void write(String string, int offset, int length) throws
IOException
+ {
+ if (length >= BUFFER_SIZE)
+ {
+ drain();
+ response.getWriter().write(string, offset, length);
Review Comment:
## CodeQL / Information exposure through an error message
[Error information](1) can be exposed to an external user.
[Error information](2) can be exposed to an external user.
[Error information](3) can be exposed to an external user.
[Error information](4) can be exposed to an external user.
[Show more
details](https://github.com/apache/myfaces/security/code-scanning/120)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
