You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@seata.apache.org by "YvCeung (via GitHub)" <gi...@apache.org> on 2025/08/24 15:57:09 UTC
[PR] bugfix:Fixed the issue where deserialization failed when the xss filt… [incubator-seata]
YvCeung opened a new pull request, #7596:
URL: https://github.com/apache/incubator-seata/pull/7596
…er obtained the default keyword
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Please make sure you have read and understood the contributing guidelines -->
- [ ] I have read the [CONTRIBUTING.md](https://github.com/apache/incubator-seata/blob/2.x/CONTRIBUTING.md) guidelines.
- [ ] I have registered the PR [changes](https://github.com/apache/incubator-seata/tree/2.x/changes).
### Ⅰ. Describe what this PR did
### Ⅱ. Does this pull request fix one issue?
<!-- If that, add "fixes #xxx" below in the next line, for example, fixes #97. -->
### Ⅲ. Why don't you add test cases (unit test/integration test)?
### Ⅳ. Describe how to verify it
### Ⅴ. Special notes for reviews
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed the issue where deserialization failed when the xss filt… [incubator-seata]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#issuecomment-3218218124
## [Codecov](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `66.66667%` with `2 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 61.42%. Comparing base ([`d42f620`](https://app.codecov.io/gh/apache/incubator-seata/commit/d42f6209d0bc42e84c84c7a574ce79ba3f594d6f?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`8b31990`](https://app.codecov.io/gh/apache/incubator-seata/commit/8b319908bdcd07299be04d63bb8175df04c3d4e0?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [...ache/seata/server/filter/XSSHttpRequestFilter.java](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?src=pr&el=tree&filepath=server%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fseata%2Fserver%2Ffilter%2FXSSHttpRequestFilter.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c2VydmVyL3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9zZWF0YS9zZXJ2ZXIvZmlsdGVyL1hTU0h0dHBSZXF1ZXN0RmlsdGVyLmphdmE=) | 60.00% | [2 Missing :warning: ](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 2.x #7596 +/- ##
============================================
+ Coverage 61.40% 61.42% +0.01%
Complexity 658 658
============================================
Files 1311 1311
Lines 49575 49572 -3
Branches 5836 5835 -1
============================================
+ Hits 30443 30449 +6
+ Misses 16412 16405 -7
+ Partials 2720 2718 -2
```
| [Files with missing lines](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [...in/java/org/apache/seata/common/DefaultValues.java](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?src=pr&el=tree&filepath=common%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fseata%2Fcommon%2FDefaultValues.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29tbW9uL3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9zZWF0YS9jb21tb24vRGVmYXVsdFZhbHVlcy5qYXZh) | `100.00% <ø> (ø)` | |
| [...s/server/filter/ServerHttpFilterXssProperties.java](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?src=pr&el=tree&filepath=seata-spring-autoconfigure%2Fseata-spring-autoconfigure-server%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fseata%2Fspring%2Fboot%2Fautoconfigure%2Fproperties%2Fserver%2Ffilter%2FServerHttpFilterXssProperties.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c2VhdGEtc3ByaW5nLWF1dG9jb25maWd1cmUvc2VhdGEtc3ByaW5nLWF1dG9jb25maWd1cmUtc2VydmVyL3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9zZWF0YS9zcHJpbmcvYm9vdC9hdXRvY29uZmlndXJlL3Byb3BlcnRpZXMvc2VydmVyL2ZpbHRlci9TZXJ2ZXJIdHRwRmlsdGVyWHNzUHJvcGVydGllcy5qYXZh) | `100.00% <100.00%> (ø)` | |
| [...ache/seata/server/filter/XSSHttpRequestFilter.java](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?src=pr&el=tree&filepath=server%2Fsrc%2Fmain%2Fjava%2Forg%2Fapache%2Fseata%2Fserver%2Ffilter%2FXSSHttpRequestFilter.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c2VydmVyL3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9zZWF0YS9zZXJ2ZXIvZmlsdGVyL1hTU0h0dHBSZXF1ZXN0RmlsdGVyLmphdmE=) | `70.00% <60.00%> (+3.33%)` | :arrow_up: |
... and [7 files with indirect coverage changes](https://app.codecov.io/gh/apache/incubator-seata/pull/7596/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
[](https://app.codecov.io/gh/apache/incubator-seata/pull/7596?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "slievrly (via GitHub)" <gi...@apache.org>.
slievrly commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297183386
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
Under what circumstances need to specify the configuration, what do not need to configure?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: fix deserialization failure when the XSS filter retrieved the default keyword [incubator-seata]
Posted by "slievrly (via GitHub)" <gi...@apache.org>.
slievrly merged PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "slievrly (via GitHub)" <gi...@apache.org>.
slievrly commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297445688
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
Why do we need user configuration? Do users need to learn such details? If users configure wrongly, does it mean we can't provide secure services? Security is not an option. At all times, the services we provide must be secure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "slievrly (via GitHub)" <gi...@apache.org>.
slievrly commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2300105790
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -59,11 +65,26 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
+
+ if (StringUtils.isBlank(xssKeywordConfig)) {
Review Comment:
If the user does not configure SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, then do not enable XSSHttpRequestFilter?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "slievrly (via GitHub)" <gi...@apache.org>.
slievrly commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297861389
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
Even if we were to allow user configuration of these rules as a last resort, the configuration must follow an append-only approach. Users should only be able to add their own rules on top of the built-in ones, not replace them. Allowing replacements would risk misconfigurations and security vulnerabilities.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung commented on PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#issuecomment-3224856824
tag `d2ca733` : Remove the global switch configuration of the filter and the switch configuration of the xss filter, and change it to forced on. The xssFilter only provides users with the ability to add keyword configurations
取消过滤器全局的开关配置以及xss过滤器的开关配置，变更为强制开启，xssFilter仅提供给用户追加风险关键字配置的能力
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297554145
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
> Why do we need user configuration? Do users need to learn such details? If users configure wrongly, does it mean we can't provide secure services? Security is not an option. At all times, the services we provide must be secure.
Ultimately, this comes down to a trade-off between prioritizing security and prioritizing flexible configuration. I believe it should be evaluated on a case-by-case basis. For example, when it comes to XSS protection, it’s impossible to anticipate every potential attack pattern. In such cases, allowing users to update configurations themselves enables a quick response to emerging threats. However, some scenarios must always prioritize security, such as enforcing HTTPS. Users should not be allowed to disable HTTPS for convenience, as doing so could expose all traffic to man-in-the-middle attacks. In situations like this, security measures should be enforced by default rather than left as a configurable option.😀
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung commented on PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#issuecomment-3226548641
> Pls review these files: https://github.com/apache/incubator-seata/blob/2.x/script/config-center/config.txt#L209 https://github.com/apache/incubator-seata/blob/2.x/server/src/main/resources/application.example.yml#L181 https://github.com/apache/incubator-seata/blob/2.x/server/src/main/resources/application.raft.example.yml#L157
done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "slievrly (via GitHub)" <gi...@apache.org>.
slievrly commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297185438
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
Security is not an option.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2298572112
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
tag: `3f85505` has completed this task
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung commented on PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#issuecomment-3222594460
@slievrly PTAL
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix: Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung closed pull request #7596: bugfix: Fixed deserialization failure when the XSS filter retrieved the default keyword.
URL: https://github.com/apache/incubator-seata/pull/7596
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "slievrly (via GitHub)" <gi...@apache.org>.
slievrly commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297851414
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
Security has to be the top priority, features come second. If a feature doesn’t meet security standards, it shouldn’t be shipped. We need to ensure safety in all known scenarios — security shouldn’t fail just because users misconfigure something or skip settings. Giving users optional security configurations is a bad idea; that choice shouldn’t be theirs. Thinking about existing web servers: which ones actually follow this rule? If they do, does that mean any security issues caused by user configurations become the user’s fault, and the project avoids getting blamed for CVEs?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297869600
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
> Even if we were to allow user configuration of these rules as a last resort, the configuration must follow an append-only approach. Users should only be able to add their own rules on top of the built-in ones, not replace them. Allowing replacements would risk misconfigurations and security vulnerabilities.
I think this is a good idea to satisfy both security and user-customised configuration. Next, I will complete the implementation of this idea in this pr.😊
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297212567
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
> Under what circumstances need to specify the configuration, what do not need to configure?
This is a default configuration. When no specific keywords are specified in the configuration file, these default configuration values will be obtained
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] bugfix:Fixed deserialization failure when the XSS filter retrieved the default keyword. [incubator-seata]
Posted by "YvCeung (via GitHub)" <gi...@apache.org>.
YvCeung commented on code in PR #7596:
URL: https://github.com/apache/incubator-seata/pull/7596#discussion_r2297221817
##########
server/src/main/java/org/apache/seata/server/filter/XSSHttpRequestFilter.java:
##########
@@ -60,21 +59,17 @@ public class XSSHttpRequestFilter implements HttpRequestFilter {
Pattern.CASE_INSENSITIVE);
public XSSHttpRequestFilter() {
- String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, null);
-
- if (StringUtils.isBlank(xssKeywordConfig)) {
- this.xssKeywords = DEFAULT_XSS_KEYWORDS;
- } else {
- ObjectMapper objectMapper = new ObjectMapper();
- try {
- xssKeywords = objectMapper.readValue(xssKeywordConfig, new TypeReference<List<String>>() {});
- } catch (JsonProcessingException e) {
- throw new IllegalArgumentException(
- "Invalid format for configuration 'server.http.filter.xss.keywords'. "
- + "Expected a JSON array like [\"<script>\", \"vbscript:\"], but got: "
- + xssKeywordConfig,
- e);
- }
+ String xssKeywordConfig = CONFIG.getConfig(SERVER_HTTP_FILTER_XSS_FILTER_KEYWORDS, DEFAULT_XSS_KEYWORDS);
Review Comment:
> Security is not an option.
The system itself reserves a switch for whether xssFilter is enabled or not. If xss protection is enabled but no specific keywords for protection are specified, the default keywords will be used
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org