Add SSTI, stored XSS, and SSRF vulnerability modules with Kotlin support#2
Add SSTI, stored XSS, and SSRF vulnerability modules with Kotlin support#2misonijnik wants to merge 1 commit intodemo/basefrom
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
src/main/kotlin/org/seqra/spring/content/NotificationTemplateService.java
Fixed
Show fixed
Hide fixed
Introduce template injection patterns (FreeMarker/Thymeleaf), cross-endpoint stored XSS flows with column-level sensitivity, SSRF via coroutine-based URL fetch, and JPA persistence layer with H2. Update README to document all vulnerability patterns and the expanded tech stack.
| } | ||
|
|
||
| public String render(String name, String content) throws IOException, TemplateException { | ||
| Template template = new Template(name, new StringReader(content), templateConfig); |
Check failure
Code scanning / OpenTaint
Unvalidated user data flows into template engine Error
| } | ||
|
|
||
| public String render(String name, String content) throws IOException, TemplateException { | ||
| Template template = new Template(name, new StringReader(content), templateConfig); |
Check failure
Code scanning / OpenTaint
Unvalidated user data flows into template engine Error
| Context context = new Context(); | ||
| context.setVariable("appName", "Demo Application"); | ||
|
|
||
| return templateEngine.process(templateContent, context); |
Check failure
Code scanning / OpenTaint
Unvalidated user data flows into template engine Error
| return ResponseEntity.ok() | ||
| .contentType(MediaType.TEXT_HTML) | ||
| .body(content); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
| return ResponseEntity.ok() | ||
| .contentType(MediaType.TEXT_HTML) | ||
| .body(title); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
| return ResponseEntity.ok() | ||
| .contentType(MediaType.TEXT_HTML) | ||
| .body(content); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
1 participant
Introduce template injection patterns (FreeMarker/Thymeleaf), cross-endpoint stored XSS flows with column-level sensitivity, SSRF via coroutine-based URL fetch, and JPA persistence layer with H2.