github-advanced-security[bot] commented on code in PR #236:
URL: https://github.com/apache/roller/pull/236#discussion_r4487015025
##########
app/src/main/java/org/apache/roller/weblogger/business/pings/WeblogUpdatePinger.java:
##########
@@ -114,42 +141,234 @@
LOGGER.debug("Executing ping to '" + pingTargetUrl + "' for
website '" + websiteUrl + "' (" + website.getName() + ")" +
(variantOptions.isEmpty() ? "" : " with variant options " + variantOptions));
}
- // Send the ping.
- XmlRpcClientConfigImpl config = new XmlRpcClientConfigImpl();
- config.setServerURL(new URL(pingTargetUrl));
- XmlRpcClient client = new XmlRpcClient();
- client.setConfig(config);
- PingResult pingResult =
parseResult(client.execute("weblogUpdates.ping", params.toArray()));
+ // Send the ping and read the response.
+ byte[] response = exchange(pingTargetUrl, buildRequest(params));
+ PingResult pingResult = parseResponse(response);
if (LOGGER.isDebugEnabled()) {
LOGGER.debug("Ping result is: " + pingResult);
}
return pingResult;
}
- private static PingResult parseResult(Object obj) {
- // Deal with the fact that some buggy ping targets may not respond
with the proper struct type.
- if (obj == null) {
- return new PingResult(null,null);
+ /**
+ * Build the XML-RPC <code>weblogUpdates.ping</code> request body for the
+ * given string parameters.
+ */
+ static String buildRequest(List<String> params) {
+ StringBuilder sb = new StringBuilder(256);
+ sb.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
+
sb.append("<methodCall><methodName>").append(PING_METHOD_NAME).append("</methodName>");
+ sb.append("<params>");
+ for (String param : params) {
+ sb.append("<param><value><string>");
+ xmlEscape(sb, param);
+ sb.append("</string></value></param>");
+ }
+ sb.append("</params></methodCall>");
+ return sb.toString();
+ }
+
+ /**
+ * POST the request body to the ping target and return the response bytes,
+ * capped at {@link #MAX_RESPONSE_BYTES}.
+ */
+ private static byte[] exchange(String pingTargetUrl, String requestBody)
throws IOException {
+ URL url = new URL(pingTargetUrl);
+ HttpURLConnection conn = (HttpURLConnection) url.openConnection();
Review Comment:
## CodeQL / Server-side request forgery
Potential server-side request forgery due to a [user-provided value](1).
[Show more
details](https://github.com/apache/roller/security/code-scanning/148)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
