How to validate and sanitize HTTP Get with Spring Boot?

I keep getting this annoying error from Checkmarx code scanner,

Method getTotalValue at line 220 of srcjavacomexamplePeopleController.java 

gets user input for the personName element. This element’s value then flows through

the code without being properly sanitized or validated and is eventually 

displayed to the user. This may enable a Cross-Site-Scripting attack.

Here is my code. I think I did ALL the validation necessary. What else???

@Slf4j

@Configuration

@RestController

@Validated 



public class PeopleController {



    @Autowired

    private PeopleRepository peopleRepository; 



    @RequestMapping(value = "/api/getTotalValue/{personName}", method = RequestMethod.GET)

    @ResponseBody

    public Integer getTotalValue(@Size(max = 20, min = 1, message = "person is not found") 

    @PathVariable(value="personName", required=true) String personName) {



        PersonObject po = peopleRepository.findByPersonName(

                            Jsoup.clean(personName, Whitelist.basic()));



        try {

            return po.getTotalValue(); 

            } catch (Exception e) {

            e.printStackTrace();

            return 0;

        }

    }  





@ExceptionHandler

    public String constraintViolationHandler(ConstraintViolationException ex) {

        return ex.getConstraintViolations().iterator().next()

                .getMessage();

    } 



}

There must be some missing validation. How to validate HTTP GET properly with Spring Boot

edited Jan 1 at 9:13

Sabir Khan

5,25931946

asked Jan 1 at 8:12

john

113323

I have tagged your question with checkmarx while you have written as Checkmarks in question description, am I correct ?

– Sabir Khan
Jan 1 at 8:21

add a comment |

I keep getting this annoying error from Checkmarx code scanner,

Method getTotalValue at line 220 of srcjavacomexamplePeopleController.java 

gets user input for the personName element. This element’s value then flows through

the code without being properly sanitized or validated and is eventually 

displayed to the user. This may enable a Cross-Site-Scripting attack.

Here is my code. I think I did ALL the validation necessary. What else???

@Slf4j

@Configuration

@RestController

@Validated 



public class PeopleController {



    @Autowired

    private PeopleRepository peopleRepository; 



    @RequestMapping(value = "/api/getTotalValue/{personName}", method = RequestMethod.GET)

    @ResponseBody

    public Integer getTotalValue(@Size(max = 20, min = 1, message = "person is not found") 

    @PathVariable(value="personName", required=true) String personName) {



        PersonObject po = peopleRepository.findByPersonName(

                            Jsoup.clean(personName, Whitelist.basic()));



        try {

            return po.getTotalValue(); 

            } catch (Exception e) {

            e.printStackTrace();

            return 0;

        }

    }  





@ExceptionHandler

    public String constraintViolationHandler(ConstraintViolationException ex) {

        return ex.getConstraintViolations().iterator().next()

                .getMessage();

    } 



}

There must be some missing validation. How to validate HTTP GET properly with Spring Boot

edited Jan 1 at 9:13

Sabir Khan

5,25931946

asked Jan 1 at 8:12

john

113323

I have tagged your question with checkmarx while you have written as Checkmarks in question description, am I correct ?

– Sabir Khan
Jan 1 at 8:21

add a comment |

I keep getting this annoying error from Checkmarx code scanner,

Method getTotalValue at line 220 of srcjavacomexamplePeopleController.java 

gets user input for the personName element. This element’s value then flows through

the code without being properly sanitized or validated and is eventually 

displayed to the user. This may enable a Cross-Site-Scripting attack.

Here is my code. I think I did ALL the validation necessary. What else???

@Slf4j

@Configuration

@RestController

@Validated 



public class PeopleController {



    @Autowired

    private PeopleRepository peopleRepository; 



    @RequestMapping(value = "/api/getTotalValue/{personName}", method = RequestMethod.GET)

    @ResponseBody

    public Integer getTotalValue(@Size(max = 20, min = 1, message = "person is not found") 

    @PathVariable(value="personName", required=true) String personName) {



        PersonObject po = peopleRepository.findByPersonName(

                            Jsoup.clean(personName, Whitelist.basic()));



        try {

            return po.getTotalValue(); 

            } catch (Exception e) {

            e.printStackTrace();

            return 0;

        }

    }  





@ExceptionHandler

    public String constraintViolationHandler(ConstraintViolationException ex) {

        return ex.getConstraintViolations().iterator().next()

                .getMessage();

    } 



}

There must be some missing validation. How to validate HTTP GET properly with Spring Boot

edited Jan 1 at 9:13

Sabir Khan

5,25931946

asked Jan 1 at 8:12

john

113323

I keep getting this annoying error from Checkmarx code scanner,

Method getTotalValue at line 220 of srcjavacomexamplePeopleController.java 

gets user input for the personName element. This element’s value then flows through

the code without being properly sanitized or validated and is eventually 

displayed to the user. This may enable a Cross-Site-Scripting attack.

Here is my code. I think I did ALL the validation necessary. What else???

@Slf4j

@Configuration

@RestController

@Validated 



public class PeopleController {



    @Autowired

    private PeopleRepository peopleRepository; 



    @RequestMapping(value = "/api/getTotalValue/{personName}", method = RequestMethod.GET)

    @ResponseBody

    public Integer getTotalValue(@Size(max = 20, min = 1, message = "person is not found") 

    @PathVariable(value="personName", required=true) String personName) {



        PersonObject po = peopleRepository.findByPersonName(

                            Jsoup.clean(personName, Whitelist.basic()));



        try {

            return po.getTotalValue(); 

            } catch (Exception e) {

            e.printStackTrace();

            return 0;

        }

    }  





@ExceptionHandler

    public String constraintViolationHandler(ConstraintViolationException ex) {

        return ex.getConstraintViolations().iterator().next()

                .getMessage();

    } 



}

There must be some missing validation. How to validate HTTP GET properly with Spring Boot

validation spring-boot http-get checkmarx

edited Jan 1 at 9:13

Sabir Khan

5,25931946

asked Jan 1 at 8:12

john

113323

edited Jan 1 at 9:13

Sabir Khan

5,25931946

asked Jan 1 at 8:12

john

113323

edited Jan 1 at 9:13

Sabir Khan

5,25931946

edited Jan 1 at 9:13

Sabir Khan

5,25931946

edited Jan 1 at 9:13

Sabir Khan

5,25931946

asked Jan 1 at 8:12

john

113323

asked Jan 1 at 8:12

john

113323

asked Jan 1 at 8:12

john

113323

I have tagged your question with checkmarx while you have written as Checkmarks in question description, am I correct ?

– Sabir Khan
Jan 1 at 8:21

add a comment |

I have tagged your question with checkmarx while you have written as Checkmarks in question description, am I correct ?

– Sabir Khan
Jan 1 at 8:21

I have tagged your question with checkmarx while you have written as Checkmarks in question description, am I correct ?

– Sabir Khan
Jan 1 at 8:21

add a comment |

1 Answer
1

active

oldest

votes

You need to be a bit careful with these scanning tools as sometimes these tools do report false positives and sometimes no code changes are required. I am no expert of checkmarx but be sure that this tool really understands bean validation annotations that you are using & the call Jsoup.clean(personName, Whitelist.basic()) .

I think I did ALL the validation necessary. What else???

First you need to understand the different between application level input sanitation & business level input validation for a controller. What you are doing here is second part & first might be missing in your set up which is exclusively done from security perspective & usually set up for whole application.

You are using @Size annotation to limit an input's size but that doesn't guarantee about bad strings - strings that can cause XSS attacks. Then, you are using call Jsoup.clean(personName, Whitelist.basic())) to clean this size validated input. As I am not sure what that call does so you need to ensure that new value is XSS - Safe. You are immediately passing that value to DB call & then returning an Integer to caller/client so I am very pessimist about any possibility of an XSS attack here but tool is saying so.

There must be some missing validation. How to validate HTTP GET
properly with Spring Boot

As I explained earlier, input validation is a term usually meant for business logic level input validation while input sanitization / clean up is about security. In Spring Boot environment, this is usually done by using Spring Security APIs & enabling XSS filters or by writing your own XSS filter and plug it in your application. Filter comes first and your controller later so your controller will always have a sanitized value & you will apply business validations on that sanitized value.

This is a broad level answer & for code etc you might do google. Also suggest to read more about XSS attacks. Just understand that there are multiple ways to accomplish same goal.

3 Ways to Prevent XSS

XSS prevention in Java

How to create filter in Spring RESTful for Prevent XSS?

Cross Site Scripting (XSS) Attack Tutorial with Examples, Types & Prevention

In last link, its mentioned ,

The first step in the prevention of this attack is Input validation.
Everything, that is entered by the user should be precisely validated,
because the user’s input may find its way to the output.

& that you are not doing in your code so I would guess that there is no XSS.

EDIT:

There are two aspects of XSS security - first not allowing malicious input to server side code & that would be done by having an XSS filter & Sometimes, there is no harm in allowing malicious input ( lets say you are saving that malicious input to DB or returning in API response ) .

Second aspect is instructing HTML clients about possible XSS attacks ( if we know for sure that API client is going to be HTML / UI ) then we need to add X-XSS-Protection header & that would be done by below code. This will enable browser to turn on its XSS protection feature ( if present ) .

@Override
protected void configure(HttpSecurity http) throws Exception {

http.headers().xssProtection()....

}

What is the http-header “X-XSS-Protection”?

Is Xss protection in Spring security enabled by default?

For first aspect i.e. writing filter - refer my this answer and links in that answer.

I think, I have wrongly written above that Spring Security provides input sanitation filters , I guess , it doesn't. Will verify and let you know. I have written my custom filter on the lines mentioned in answer to this question - Prevent XSS in Spring MVC controller

You have to also understand that Spring Boot gets used to write traditional MVC apps too where server side presents HTML to render too . In case of JSON responses ( REST APIs ) , UI client can control what to escape and what not, complexity arises because JSON output is not always fed to HTML clients aka browsers.

edited Jan 3 at 9:06

answered Jan 1 at 9:49

Sabir Khan

5,25931946

Thank you. i use Spring Security. How can I enable XSS filters? Is there any special annotation ? Currently I have @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity

– john
Jan 3 at 1:16

I have edited my answer to answer your question.

– Sabir Khan
Jan 3 at 9:01

add a comment |

Your Answer

StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");

StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});

function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});

}
});

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53993980%2fhow-to-validate-and-sanitize-http-get-with-spring-boot%23new-answer', 'question_page');
}
);

Post as a guest

Name

Required, but never shown

1 Answer
1

active

oldest

votes

1 Answer
1

active

oldest

votes

I think I did ALL the validation necessary. What else???

There must be some missing validation. How to validate HTTP GET
properly with Spring Boot

This is a broad level answer & for code etc you might do google. Also suggest to read more about XSS attacks. Just understand that there are multiple ways to accomplish same goal.

3 Ways to Prevent XSS

XSS prevention in Java

How to create filter in Spring RESTful for Prevent XSS?

Cross Site Scripting (XSS) Attack Tutorial with Examples, Types & Prevention

In last link, its mentioned ,

The first step in the prevention of this attack is Input validation.
Everything, that is entered by the user should be precisely validated,
because the user’s input may find its way to the output.

& that you are not doing in your code so I would guess that there is no XSS.

EDIT:

@Override
protected void configure(HttpSecurity http) throws Exception {

http.headers().xssProtection()....

}

What is the http-header “X-XSS-Protection”?

Is Xss protection in Spring security enabled by default?

For first aspect i.e. writing filter - refer my this answer and links in that answer.

edited Jan 3 at 9:06

answered Jan 1 at 9:49

Sabir Khan

5,25931946

Thank you. i use Spring Security. How can I enable XSS filters? Is there any special annotation ? Currently I have @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity

– john
Jan 3 at 1:16

I have edited my answer to answer your question.

– Sabir Khan
Jan 3 at 9:01

add a comment |

I think I did ALL the validation necessary. What else???

There must be some missing validation. How to validate HTTP GET
properly with Spring Boot

This is a broad level answer & for code etc you might do google. Also suggest to read more about XSS attacks. Just understand that there are multiple ways to accomplish same goal.

3 Ways to Prevent XSS

XSS prevention in Java

How to create filter in Spring RESTful for Prevent XSS?

Cross Site Scripting (XSS) Attack Tutorial with Examples, Types & Prevention

In last link, its mentioned ,

The first step in the prevention of this attack is Input validation.
Everything, that is entered by the user should be precisely validated,
because the user’s input may find its way to the output.

& that you are not doing in your code so I would guess that there is no XSS.

EDIT:

@Override
protected void configure(HttpSecurity http) throws Exception {

http.headers().xssProtection()....

}

What is the http-header “X-XSS-Protection”?

Is Xss protection in Spring security enabled by default?

For first aspect i.e. writing filter - refer my this answer and links in that answer.

edited Jan 3 at 9:06

answered Jan 1 at 9:49

Sabir Khan

5,25931946

Thank you. i use Spring Security. How can I enable XSS filters? Is there any special annotation ? Currently I have @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity

– john
Jan 3 at 1:16

I have edited my answer to answer your question.

– Sabir Khan
Jan 3 at 9:01

add a comment |

I think I did ALL the validation necessary. What else???

There must be some missing validation. How to validate HTTP GET
properly with Spring Boot

This is a broad level answer & for code etc you might do google. Also suggest to read more about XSS attacks. Just understand that there are multiple ways to accomplish same goal.

3 Ways to Prevent XSS

XSS prevention in Java

How to create filter in Spring RESTful for Prevent XSS?

Cross Site Scripting (XSS) Attack Tutorial with Examples, Types & Prevention

In last link, its mentioned ,

The first step in the prevention of this attack is Input validation.
Everything, that is entered by the user should be precisely validated,
because the user’s input may find its way to the output.

& that you are not doing in your code so I would guess that there is no XSS.

EDIT:

@Override
protected void configure(HttpSecurity http) throws Exception {

http.headers().xssProtection()....

}

What is the http-header “X-XSS-Protection”?

Is Xss protection in Spring security enabled by default?

For first aspect i.e. writing filter - refer my this answer and links in that answer.

edited Jan 3 at 9:06

answered Jan 1 at 9:49

Sabir Khan

5,25931946

I think I did ALL the validation necessary. What else???

There must be some missing validation. How to validate HTTP GET
properly with Spring Boot

This is a broad level answer & for code etc you might do google. Also suggest to read more about XSS attacks. Just understand that there are multiple ways to accomplish same goal.

3 Ways to Prevent XSS

XSS prevention in Java

How to create filter in Spring RESTful for Prevent XSS?

Cross Site Scripting (XSS) Attack Tutorial with Examples, Types & Prevention

In last link, its mentioned ,

The first step in the prevention of this attack is Input validation.
Everything, that is entered by the user should be precisely validated,
because the user’s input may find its way to the output.

& that you are not doing in your code so I would guess that there is no XSS.

EDIT:

@Override
protected void configure(HttpSecurity http) throws Exception {

http.headers().xssProtection()....

}

What is the http-header “X-XSS-Protection”?

Is Xss protection in Spring security enabled by default?

For first aspect i.e. writing filter - refer my this answer and links in that answer.

edited Jan 3 at 9:06

answered Jan 1 at 9:49

Sabir Khan

5,25931946

edited Jan 3 at 9:06

answered Jan 1 at 9:49

Sabir Khan

5,25931946

answered Jan 1 at 9:49

Sabir Khan

5,25931946

answered Jan 1 at 9:49

Sabir Khan

5,25931946

Thank you. i use Spring Security. How can I enable XSS filters? Is there any special annotation ? Currently I have @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity

– john
Jan 3 at 1:16

I have edited my answer to answer your question.

– Sabir Khan
Jan 3 at 9:01

add a comment |

Thank you. i use Spring Security. How can I enable XSS filters? Is there any special annotation ? Currently I have @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity

– john
Jan 3 at 1:16

I have edited my answer to answer your question.

– Sabir Khan
Jan 3 at 9:01

Thank you. i use Spring Security. How can I enable XSS filters? Is there any special annotation ? Currently I have @Configuration @EnableWebSecurity @EnableGlobalMethodSecurity

– john
Jan 3 at 1:16

I have edited my answer to answer your question.

– Sabir Khan
Jan 3 at 9:01

add a comment |

draft saved

draft discarded

Thanks for contributing an answer to Stack Overflow!

Please be sure to answer the question. Provide details and share your research!

But avoid …

Asking for help, clarification, or responding to other answers.

Making statements based on opinion; back them up with references or personal experience.

To learn more, see our tips on writing great answers.

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Sign up or log in

StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});

Post as a guest

Name

Required, but never shown

Name

Required, but never shown

Name

Required, but never shown

This page is only for reference, If you need detailed information, please check here

Search This Blog

Ufyukyu