[
https://issues.apache.org/jira/browse/WW-5741?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Lukasz Lenart resolved WW-5741.
-------------------------------
Resolution: Fixed
> Dismiss the CodeQL java/xss alert on
> DefaultContentTypeHandlerManager.handleResult as a false positive
> ------------------------------------------------------------------------------------------------------
>
> Key: WW-5741
> URL: https://issues.apache.org/jira/browse/WW-5741
> Project: Struts 2
> Issue Type: Task
> Components: Plugin - REST
> Reporter: Lukasz Lenart
> Priority: Trivial
> Fix For: 7.4.0
>
>
> CodeQL alert #159 ({{java/xss}}, open since 2022-10-25) flags
> {{DefaultContentTypeHandlerManager.handleResult}}, where the body a
> {{ContentTypeHandler}} wrote into a {{StringWriter}} is copied to the
> response. It has been failing the CodeQL check on unrelated pull requests
> (most recently #1937).
> It is a false positive. The sink writes whatever the negotiated handler
> produced, under that handler's own content type:
> * {{JacksonJsonHandler}}, {{JacksonXmlHandler}}, {{JuneauXmlHandler}},
> {{XStreamHandler}} serialize the target object as JSON or XML — structurally
> escaped by the serializer, {{application/json}} / {{application/xml}}, never
> {{text/html}}
> * {{HtmlHandler.fromObject}} writes nothing and returns the result code, so
> an xhtml result is rendered by a template, not by this branch
> * {{FormUrlEncodedHandler}} and {{MultipartFormDataHandler}} are request-side
> handlers; {{fromObject}} returns null
> CodeQL traces request parameter → model property → serializer →
> {{OutputStream.write}} without seeing that the content type is not renderable
> as HTML.
> Options, in order of preference:
> # Dismiss alert #159 as _false positive_ on GitHub, with this reasoning in
> the dismissal comment.
> # If a code-level signal is wanted, wrap the write in a method whose Javadoc
> records why the sink is not an HTML context; the behaviour must not change.
> Either way the CodeQL check stops failing on PRs that do not touch the plugin.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
