You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by "rombert (via GitHub)" <gi...@apache.org> on 2024/10/11 13:24:19 UTC

[PR] SLING-12451 - Commons Crypto web console does not show ciphertext after submission [sling-org-apache-sling-commons-crypto]

rombert opened a new pull request, #3:
URL: https://github.com/apache/sling-org-apache-sling-commons-crypto/pull/3

   Replace the submit handling with a plain redirect. Supressed the false positive UNVALIDATED_REDIRECT.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] SLING-12451 - Commons Crypto web console does not show ciphertext after submission [sling-org-apache-sling-commons-crypto]

Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #3:
URL: https://github.com/apache/sling-org-apache-sling-commons-crypto/pull/3#issuecomment-2407574143

   ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3) **Quality Gate passed**  
   Issues  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3&issueStatuses=ACCEPTED)
   
   Measures  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [100.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3&metric=new_coverage&view=list)  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3&metric=new_duplicated_lines_density&view=list)  
     
   [See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] SLING-12451 - Commons Crypto web console does not show ciphertext after submission [sling-org-apache-sling-commons-crypto]

Posted by "sonarcloud[bot] (via GitHub)" <gi...@apache.org>.
sonarcloud[bot] commented on PR #3:
URL: https://github.com/apache/sling-org-apache-sling-commons-crypto/pull/3#issuecomment-2407424679

   ## [![Quality Gate Failed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-failed-20px.png 'Quality Gate Failed')](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3) **Quality Gate failed**  
   Failed conditions  
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/failed-16px.png '') [E Security Rating on New Code](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3) (required ≥ A)  
     
   [See analysis details on SonarCloud](https://sonarcloud.io/dashboard?id=apache_sling-org-apache-sling-commons-crypto&pullRequest=3)
   
   ##   
   ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/light_bulb-16px.png '') Catch issues before they fail your Quality Gate with our IDE extension ![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/sonarlint-16px.png '') [SonarLint](https://www.sonarsource.com/products/sonarlint/features/connected-mode/?referrer=pull-request)
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] SLING-12451 - Commons Crypto web console does not show ciphertext after submission [sling-org-apache-sling-commons-crypto]

Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on PR #3:
URL: https://github.com/apache/sling-org-apache-sling-commons-crypto/pull/3#issuecomment-2417959294

   Less intrusive fix via e28fa4aca024dedaeea690f231981d544902c1e5.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] SLING-12451 - Commons Crypto web console does not show ciphertext after submission [sling-org-apache-sling-commons-crypto]

Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert commented on code in PR #3:
URL: https://github.com/apache/sling-org-apache-sling-commons-crypto/pull/3#discussion_r1796967532


##########
src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java:
##########
@@ -98,19 +98,16 @@
             writer.println("<p>No crypto service available</p>");
         }
 
-        final String forwardRequestUri = (String) request.getAttribute(RequestDispatcher.FORWARD_REQUEST_URI);
-        if (Objects.nonNull(forwardRequestUri) && forwardRequestUri.equals(request.getRequestURI())) {
-            final String ciphertext = (String) request.getAttribute(ATTRIBUTE_CIPHERTEXT);
-            if (Objects.nonNull(ciphertext)) {
-                final String html = String.format("<p id=\"ciphertext\">Encrypted message: %s</p>", ciphertext);
-                writer.println(html);
-            }
+        final String ciphertext = request.getParameter(PARAMETER_CIPHERTEXT);
+        if (Objects.nonNull(ciphertext)) {
+            final String html = String.format("<p id=\"ciphertext\">Encrypted message: %s</p>", ciphertext);
+            writer.println(html);

Review Comment:
   Fair enough, will fix.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] SLING-12451 - Commons Crypto web console does not show ciphertext after submission [sling-org-apache-sling-commons-crypto]

Posted by "rombert (via GitHub)" <gi...@apache.org>.
rombert closed pull request #3: SLING-12451 - Commons Crypto web console does not show ciphertext after submission
URL: https://github.com/apache/sling-org-apache-sling-commons-crypto/pull/3


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] SLING-12451 - Commons Crypto web console does not show ciphertext after submission [sling-org-apache-sling-commons-crypto]

Posted by "github-advanced-security[bot] (via GitHub)" <gi...@apache.org>.
github-advanced-security[bot] commented on code in PR #3:
URL: https://github.com/apache/sling-org-apache-sling-commons-crypto/pull/3#discussion_r1796964897


##########
src/main/java/org/apache/sling/commons/crypto/webconsole/internal/EncryptWebConsolePlugin.java:
##########
@@ -98,19 +98,16 @@
             writer.println("<p>No crypto service available</p>");
         }
 
-        final String forwardRequestUri = (String) request.getAttribute(RequestDispatcher.FORWARD_REQUEST_URI);
-        if (Objects.nonNull(forwardRequestUri) && forwardRequestUri.equals(request.getRequestURI())) {
-            final String ciphertext = (String) request.getAttribute(ATTRIBUTE_CIPHERTEXT);
-            if (Objects.nonNull(ciphertext)) {
-                final String html = String.format("<p id=\"ciphertext\">Encrypted message: %s</p>", ciphertext);
-                writer.println(html);
-            }
+        final String ciphertext = request.getParameter(PARAMETER_CIPHERTEXT);
+        if (Objects.nonNull(ciphertext)) {
+            final String html = String.format("<p id=\"ciphertext\">Encrypted message: %s</p>", ciphertext);
+            writer.println(html);

Review Comment:
   ## Endpoints should not be vulnerable to reflected cross-site scripting (XSS) attacks
   
   <!--SONAR_ISSUE_KEY:AZJ7x2KNK_WRkc9E9YvU-->Change this code to not reflect user-controlled data. <p>See more on <a href="https://sonarcloud.io/project/issues?id=apache_sling-org-apache-sling-commons-crypto&issues=AZJ7x2KNK_WRkc9E9YvU&open=AZJ7x2KNK_WRkc9E9YvU&pullRequest=3">SonarCloud</a></p>
   
   [Show more details](https://github.com/apache/sling-org-apache-sling-commons-crypto/security/code-scanning/1)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@sling.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org