hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-04-28 02:05:14 +02:00
Code Issues Packages Projects Releases Wiki Activity

Spring content types: recognise constant content-type strings

Browse Source
This commit is contained in:
Chris Smowton
2021-06-22 19:26:16 +01:00
parent 4397371a50
commit 701d0bcdca
3 changed files with 24 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
java/ql/test/query-tests/security/CWE-079/semmle/tests/SpringXSS.java
View File

@@ -60,7 +60,7 @@ public class SpringXSS {
@GetMapping(value = "/xyz", produces = MediaType.TEXT_HTML_VALUE)
public static ResponseEntity<String> methodContentTypeUnsafe(String userControlled) {
return ResponseEntity.ok(userControlled); // $MISSING: xss
return ResponseEntity.ok(userControlled); // $xss
}
@GetMapping(value = "/xyz", produces = "text/html")