Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix code scanning alert no. 13: Cross-site scripting #2610

Merged
merged 1 commit into from
Oct 21, 2024
Merged

Conversation

velo
Copy link
Member

@velo velo commented Oct 21, 2024

Fixes https://github.com/OpenFeign/feign/security/code-scanning/13

To fix the cross-site scripting vulnerability, we need to ensure that any user-provided data included in the HTTP response is properly sanitized or encoded. In this case, we can use a library like Apache Commons Text to escape the content of the files before including them in the response. This will prevent any malicious scripts from being executed in the user's browser.

  1. Add the Apache Commons Text library to the project dependencies if it is not already included.
  2. Import the necessary classes from the Apache Commons Text library.
  3. Escape the content of the files using StringEscapeUtils.escapeHtml4 before including them in the result variable.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
@velo velo merged commit ca15b95 into master Oct 21, 2024
3 of 5 checks passed
@velo velo deleted the alert-autofix-13 branch October 21, 2024 15:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant