Skip to content

Add XSS with different complexity levels#3

Open
misonijnik wants to merge 1 commit intodemo/basefrom
demo/xss-complexity
Open

Add XSS with different complexity levels#3
misonijnik wants to merge 1 commit intodemo/basefrom
demo/xss-complexity

Conversation

@misonijnik
Copy link
Member

No description provided.

This reverts commit e083d9e36b074185b22f13bd2267ceda269a203c.
public String displayUserProfile(
@RequestParam(defaultValue = "Welcome") String message) {
// Direct output without escaping
return "<html><body><h1>Profile Message: " + message + "</h1></body></html>";

Check failure

Code scanning / OpenTaint

Potential cross-site scripting (XSS) Error

Potential XSS: writing user input directly to a web page.
// Assign to local variable
String htmlContent = "<html><body><h1>User Status: " +
message + "</h1></body></html>";
return htmlContent;

Check failure

Code scanning / OpenTaint

Potential cross-site scripting (XSS) Error

Potential XSS: writing user input directly to a web page.
public String generateDashboard(
@RequestParam(defaultValue = "Welcome") String greeting) {
String htmlContent = buildDashboardContent(greeting);
return htmlContent;

Check failure

Code scanning / OpenTaint

Potential cross-site scripting (XSS) Error

Potential XSS: writing user input directly to a web page.
@RequestParam(defaultValue = "New Message") String content) {
Profile.MessageTemplate template = new Profile.MessageTemplate(content);
// Return nested content
return template.body.content.text;

Check failure

Code scanning / OpenTaint

Potential cross-site scripting (XSS) Error

Potential XSS: writing user input directly to a web page.
Profile.UserProfile profile = new Profile.UserProfile(content);

// Return nested content
return profile.settings.config.template.body.content.text;

Check failure

Code scanning / OpenTaint

Potential cross-site scripting (XSS) Error

Potential XSS: writing user input directly to a web page.
// Construct a page using a chain of builders
String page = new HtmlPageBuilder().message(message).buildPage();

return page;

Check failure

Code scanning / OpenTaint

Potential cross-site scripting (XSS) Error

Potential XSS: writing user input directly to a web page.
String page = new HtmlPageBuilder().message(message)
.format(new DefaultFormatter()).buildPage();

return page;

Check failure

Code scanning / OpenTaint

Potential cross-site scripting (XSS) Error

Potential XSS: writing user input directly to a web page.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant