Lukasz Lenart created WW-5741:
---------------------------------
Summary: Dismiss the CodeQL java/xss alert on
DefaultContentTypeHandlerManager.handleResult as a false positive
Key: WW-5741
URL: https://issues.apache.org/jira/browse/WW-5741
Project: Struts 2
Issue Type: Task
Components: Plugin - REST
Reporter: Lukasz Lenart
Fix For: 7.4.0
CodeQL alert #159 ({{java/xss}}, open since 2022-10-25) flags
{{DefaultContentTypeHandlerManager.handleResult}}, where the body a
{{ContentTypeHandler}} wrote into a {{StringWriter}} is copied to the response.
It has been failing the CodeQL check on unrelated pull requests (most recently
#1937).
It is a false positive. The sink writes whatever the negotiated handler
produced, under that handler's own content type:
* {{JacksonJsonHandler}}, {{JacksonXmlHandler}}, {{JuneauXmlHandler}},
{{XStreamHandler}} serialize the target object as JSON or XML — structurally
escaped by the serializer, {{application/json}} / {{application/xml}}, never
{{text/html}}
* {{HtmlHandler.fromObject}} writes nothing and returns the result code, so an
xhtml result is rendered by a template, not by this branch
* {{FormUrlEncodedHandler}} and {{MultipartFormDataHandler}} are request-side
handlers; {{fromObject}} returns null
CodeQL traces request parameter → model property → serializer →
{{OutputStream.write}} without seeing that the content type is not renderable
as HTML.
Options, in order of preference:
# Dismiss alert #159 as _false positive_ on GitHub, with this reasoning in the
dismissal comment.
# If a code-level signal is wanted, wrap the write in a method whose Javadoc
records why the sink is not an HTML context; the behaviour must not change.
Either way the CodeQL check stops failing on PRs that do not touch the plugin.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
