Skip to content

Potential Vulnerability in Cloned Code#6

Open
bugfinderbot wants to merge 1 commit intospringboot4:masterfrom
bugfinderbot:cve-req
Open

Potential Vulnerability in Cloned Code#6
bugfinderbot wants to merge 1 commit intospringboot4:masterfrom
bugfinderbot:cve-req

Conversation

@bugfinderbot
Copy link

This PR fixes a potential security vulnerability in doFilterInternal() that was cloned from ballcat-projects/ballcat@2519b52 but did not receive the security patch.

Details:

Affected Function: doFilterInternal() in XssFilter.java
Original Fix: ballcat-projects/ballcat@2519b52

What this PR does:

This PR applies the same security patch that was applied to the original repository to eliminate the potential vulnerability in the cloned code.

References:

ballcat-projects/ballcat@2519b52
https://cwe.mitre.org/data/definitions/352.html

Please review and merge this PR to ensure your repository is protected against this potential vulnerability.

Copy link

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR intends to apply an upstream security patch to the XSS filter’s doFilterInternal() implementation to address a potential vulnerability in the cloned code.

Changes:

  • Adds an XssCleaner dependency to XssFilter
  • Updates doFilterInternal() to pass an XssCleaner into XssRequestWrapper

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment on lines +42 to +43
private final XssCleaner xssCleaner;

Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

XssCleaner is referenced as a new dependency, but there is no XssCleaner type defined anywhere in this module/repo (searching under art-spring-boot-starter-xss only finds this file). This will not compile unless you add/introduce the XssCleaner type (and ensure it is a Spring bean), or replace it with an existing cleaner implementation used by the project.

Copilot uses AI. Check for mistakes.
Comment on lines 62 to 64
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain, XssCleaner xssCleaner)
throws ServletException, IOException {
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OncePerRequestFilter#doFilterInternal must have the exact 3-argument signature (HttpServletRequest, HttpServletResponse, FilterChain). Adding XssCleaner as a 4th parameter breaks the @Override contract and will cause compilation failure. Use the injected field (this.xssCleaner) inside the method instead of changing the override signature.

Copilot uses AI. Check for mistakes.
Comment on lines +65 to 66
filterChain.doFilter(new XssRequestWrapper(request,xssCleaner), response);
}
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

XssRequestWrapper currently only has a constructor that accepts (HttpServletRequest); there is no (HttpServletRequest, XssCleaner) constructor. Either update XssRequestWrapper accordingly (and implement how XssCleaner is used), or keep using the existing constructor here.

Copilot uses AI. Check for mistakes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants