Add OpenTaint + ZAP action and more controllers#4
Add OpenTaint + ZAP action and more controllers#4seqradev wants to merge 1 commit intodemo/endpointsfrom
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
misonijnik
force-pushed
the
demo/endpoints
branch
from
e8d2b6d to
beda2ba
Compare
| return ResponseEntity.ok(Map.of( | ||
| "template", template, | ||
| "preview", preview != null ? preview.toString() : "", | ||
| "sampleData", sampleData | ||
| )); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
| sampleData.forEach(context::setVariable); | ||
|
|
||
| Expression exp = parser.parseExpression(template); | ||
| Object preview = exp.getValue(context); |
Check failure
Code scanning / OpenTaint
Potential expression language injection Error
| return ResponseEntity.ok(Map.of( | ||
| "expression", expr, | ||
| "result", result != null ? result : 0, | ||
| "success", true | ||
| )); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
|
|
||
| try { | ||
| Expression expression = parser.parseExpression(expr); | ||
| Object result = expression.getValue(); |
Check failure
Code scanning / OpenTaint
Potential expression language injection Error
| return ResponseEntity.ok(Map.of( | ||
| "template", template, | ||
| "rendered", rendered != null ? rendered.toString() : "", | ||
| "userName", userName | ||
| )); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
| response.setHeader("X-Campaign", campaign); | ||
| } | ||
|
|
||
| response.sendRedirect(destination); |
Check warning
Code scanning / OpenTaint + ZAP
Application redirects to user-manipulated URL which can be malicious Warning
| } | ||
|
|
||
| if (campaign != null) { | ||
| response.setHeader("X-Campaign", campaign); |
Check warning
Code scanning / OpenTaint
HTTP response splitting Warning
| HttpServletResponse response) throws IOException { | ||
|
|
||
| if (trackingId != null) { | ||
| response.setHeader("X-Tracking-ID", trackingId); |
Check warning
Code scanning / OpenTaint
HTTP response splitting Warning
| response.setHeader("X-Custom-Header", headerValue); | ||
| } | ||
|
|
||
| response.setHeader("Location", url); |
Check warning
Code scanning / OpenTaint
HTTP response splitting Warning
| HttpServletResponse response) throws IOException { | ||
|
|
||
| if (headerValue != null && !headerValue.isEmpty()) { | ||
| response.setHeader("X-Custom-Header", headerValue); |
Check warning
Code scanning / OpenTaint
HTTP response splitting Warning
2 participants
No description provided.