Skip to content

Potential Vulnerability in Cloned Code #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bugfinderbot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Potential Vulnerability in Cloned Code #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions ...k/art-spring-boot-starter-xss/src/main/java/com/art/common/xss/core/filter/XssFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,8 @@ public class XssFilter extends OncePerRequestFilter {

private final PathMatcher pathMatcher;

private final XssCleaner xssCleaner;

Comment on lines +42 to +43
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

XssCleaner is referenced as a new dependency, but there is no XssCleaner type defined anywhere in this module/repo (searching under art-spring-boot-starter-xss only finds this file). This will not compile unless you add/introduce the XssCleaner type (and ensure it is a Spring bean), or replace it with an existing cleaner implementation used by the project.

Copilot uses AI. Check for mistakes.
@Override
protected boolean shouldNotFilter(HttpServletRequest request) {
if (!xssProperties.isEnable()) {
Expand All @@ -58,9 +60,9 @@ protected boolean shouldNotFilter(HttpServletRequest request) {
* @throws IOException
*/
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain, XssCleaner xssCleaner)
throws ServletException, IOException {
Comment on lines 62 to 64
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OncePerRequestFilter#doFilterInternal must have the exact 3-argument signature (HttpServletRequest, HttpServletResponse, FilterChain). Adding XssCleaner as a 4th parameter breaks the @Override contract and will cause compilation failure. Use the injected field (this.xssCleaner) inside the method instead of changing the override signature.

Copilot uses AI. Check for mistakes.
filterChain.doFilter(new XssRequestWrapper(request), response);
filterChain.doFilter(new XssRequestWrapper(request,xssCleaner), response);
}
Comment on lines +65 to 66
Copy link

Copilot AI Mar 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

XssRequestWrapper currently only has a constructor that accepts (HttpServletRequest); there is no (HttpServletRequest, XssCleaner) constructor. Either update XssRequestWrapper accordingly (and implement how XssCleaner is used), or keep using the existing constructor here.

Copilot uses AI. Check for mistakes.

}