59 lines
1.9 KiB
Plaintext
59 lines
1.9 KiB
Plaintext
=== How to fix it in Spring
|
|
|
|
The following code is vulnerable to cross-site scripting because it returns an HTML response that contains user input.
|
|
|
|
If you do not intend to send HTML code to clients, the vulnerability can be fixed by specifying the type of data returned in the response.
|
|
For example, you can use the `produces` property of the `GetMapping` annotation.
|
|
|
|
==== Noncompliant code example
|
|
|
|
[source,java,diff-id=1,diff-type=noncompliant]
|
|
----
|
|
@RestController
|
|
public class ApiController
|
|
{
|
|
@GetMapping(value = "/endpoint")
|
|
public String endpoint(@RequestParam("input") input)
|
|
{
|
|
return input;
|
|
}
|
|
}
|
|
----
|
|
|
|
==== Compliant solution
|
|
|
|
[source,java,diff-id=1,diff-type=compliant]
|
|
----
|
|
@RestController
|
|
public class ApiController
|
|
{
|
|
@GetMapping(value = "/endpoint", produces = "text/plain")
|
|
public String endpoint(@RequestParam("input") input)
|
|
{
|
|
return input;
|
|
}
|
|
}
|
|
----
|
|
|
|
=== How does this work?
|
|
|
|
If the HTTP response is HTML code, it is highly recommended to use a template engine like https://www.thymeleaf.org/[Thymeleaf] to generate it.
|
|
This template engine separates the view from the business logic and automatically encodes the output of variables, drastically reducing the risk of cross-site scripting vulnerabilities.
|
|
|
|
If you do not intend to send HTML code to clients, the vulnerability can be fixed by specifying the type of data returned in the response with the `content-type` HTTP header.
|
|
This header tells the browser that the response does not contain HTML code and should not be parsed and interpreted as HTML.
|
|
Thus, the response is not vulnerable to reflected cross-site scripting.
|
|
|
|
For example, setting the content-type to `text/plain` allows to safely reflect user input since browsers will not try to parse and execute the response.
|
|
|
|
=== Pitfalls
|
|
|
|
include::../../common/pitfalls/content-types.adoc[]
|
|
|
|
include::../../common/pitfalls/validation.adoc[]
|
|
|
|
=== Going the extra mile
|
|
|
|
include::../../common/extra-mile/csp.adoc[]
|
|
|