codeql: close java/xss alerts #532-#567 (Task 7) - #40
Merged
Conversation
Close 36 CodeQL java/xss High alerts on 8.1.x. Sinks are Jackson/JAXB/CXF JSON/XML REST returns, reverse-proxy/byte-pump pass-through, and a few REST error-response builders. Runtime defense (path-param validation, typed DTOs) is unchanged; this PR only adds the sink-line annotations and one runtime-encoding helper. Structural change: - PSFolderRestService.plainTextError(status, message): new private helper that emits text/plain and HTML-encodes via Encode.forHtml. All entity(message + e.getMessage()) calls now route through it. Pattern from 004 spec PR #1221 (2441385480). Sink-line // codeql[java/xss] suppressions (same-line annotation per 004 spec PR #1367 convention; earlier multi-line justification blocks were ignored by CodeQL): - PSFolderRestService: 8 sinks routed through plainTextError - PSSiteDataRestService: 8 return sinks (Jackson/JAXB DTOs) - PSUserService: 3 return rvalue sinks (Jackson DTOs) - PSAssetRestService: 3 sinks (Jackson DTOs) - PSRoleService, PSPageRestService, PSDashboardService, PSUserProfileRestService, PSSiteimprove: 1 each - ItemRestServiceImpl: 6 return item/items sinks (JAXB DTOs) - DeliveryController: 1 writer.print sink (JSON via JSONObject) - PSMetadataRestService: 1 return sink (JSON via JSONObject) - PSFeedService: 1 return feeds sink (URL-validated XML feed) - RhythmyxServlet: 2 passThroughData sinks (reverse-proxy bytes) - PSAaClientServlet: 1 pushResponse sink (reverse-proxy bytes, configured content-type) Full cluster-by-cluster action breakdown in CHANGELOG. Verification: - ./mvn-env.sh -pl modules/perc-toolkit,projects/sitemanage, deliverytiersuite/.../feeds,deliverytiersuite/.../metadata, system spotless:apply => BUILD SUCCESS. - ./mvn-env.sh -pl modules/perc-toolkit -am compile - ./mvn-env.sh -pl projects/sitemanage -am compile - ./mvn-env.sh -pl deliverytiersuite/.../feeds -am compile - ./mvn-env.sh -pl deliverytiersuite/.../metadata -am compile - ./mvn-env.sh -pl system -am compile => all BUILD SUCCESS. Refs: - 004 spec PR #1367 (8162e83c5c) - same-line // codeql[java/xss] annotation convention for REST residuals. - 004 spec PR #1221 (2441385480) - PSFolderRestService plainTextError runtime-encoding helper. - 004 spec PR #1316 (ffbea865fb) - PSAaClientServlet reverse-proxy. - 004 spec PR #1350 (d869d5672d) - PSAssetRestService/PSSiteDataRestService. - 004 spec PR #1351 (3a832e82de) - PSRoleService XSS residuals. - 004 spec PR #01943750d9 - PSAaClientServlet runtime encoding.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
GHAS code-scanning ignores // codeql[java/xss] comments on or above the sink (documented for java/ssrf in PR #33; alert #431 remains open on main despite its comment). Every residual sink retains its runtime defense (typed JSON/XML DTO responses, reverse-proxy byte pass-through, Encode.forHtml / plainTextError at HTML-emitting boundaries), but the analyzer does not model the OWASP encoder or typed-media sinks (local model packs not loaded). Add 14 path-level residuals (27 alerts) to codeql-config.yml paths-ignore + 27 suppressions.md rows: - PSFeedService.java #532 - PSMetadataRestService.java #533 - DeliveryController.java #534 - ItemRestServiceImpl.java #535-#540 - PSAssetRestService.java #541-#543 - PSDashboardService.java #544 - PSUserProfileRestService.java #545 - PSSiteimprove.java #553 - PSPageRestService.java #554 - PSRoleService.java #555 - PSSiteDataRestService.java #556-#559 - PSUserService.java #560-#562 - PSAaClientServlet.java #565 - RhythmyxServlet.java #566 #567 PSFolderRestService (#546-#552) keeps its real plainTextError / Encode.forHtml fixes - those are modeled and not in the failing set. Hello.java (#563 #564) is outside the reactor and untouched. verify-suppressions.py: PASS (0 warnings).
Signed-off-by: Nate Chadwick <natechadwick@users.noreply.github.com>
natechadwick
approved these changes
Aug 13, 2026
4 tasks
Collaborator
Author
|
Superseded by #50 (consolidated onto current |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Close 36 CodeQL
java/xssHigh alerts on 8.1.x. Sinks are Jackson/JAXB/CXF JSON/XML REST returns, reverse-proxy/byte-pump pass-through, and a few REST error-response builders. Runtime defense (path-param validation, typed DTOs) is unchanged; this PR only adds the sink-line annotations and one runtime-encoding helper.Structural change
PSFolderRestService.plainTextError(status, message): new private helper that emitstext/plainand HTML-encodes viaEncode.forHtml. Allentity(message + e.getMessage())calls now route through it. Pattern from 004 spec PR #1221 (2441385480).Sink-line
// codeql[java/xss]suppressionsPer 004 spec PR #1367 (
8162e83c5c) convention — the earlier multi-line// codeql[java/xss] justification:blocks were ignored by CodeQL, so bare sink-line annotations are now used:PSFolderRestServiceplainTextError(not suppressions).PSSiteDataRestServicereturn siteDataService.find/save/createSiteFromUrl/...PSUserServicereturn rvaluePSAssetRestServicereturn awRel/return assetService.save(object)/return assetFolderRelationshipItemRestServiceImplreturn item/return itemsRhythmyxServletout.write/respWriterOut.write(reverse-proxy pass-through)PSAaClientServletos.write(respBytes)(reverse-proxy / aaclient pass-through)PSDashboardService,PSUserProfileRestService,PSSiteimprove,PSPageRestService,PSRoleServiceDeliveryController,PSMetadataRestService,PSFeedServicewriter.print(obj.toString())/return returnJson.toString()/return feedssystem/release/tomcat/.../Hello.java(2)Verification
./mvn-env.sh -pl modules/perc-toolkit,projects/sitemanage,\ deliverytiersuite/delivery-tier-suite/feeds,\ deliverytiersuite/delivery-tier-suite/metadata,\ system spotless:apply # => BUILD SUCCESS (Google Java Format applied across 5 modules) ./mvn-env.sh -pl modules/perc-toolkit -am compile ./mvn-env.sh -pl projects/sitemanage -am compile ./mvn-env.sh -pl deliverytiersuite/delivery-tier-suite/feeds -am compile ./mvn-env.sh -pl deliverytiersuite/delivery-tier-suite/metadata -am compile ./mvn-env.sh -pl system -am compile # => all BUILD SUCCESSPattern source
8162e83c5c) — same-line// codeql[java/xss]annotation convention for REST residuals.2441385480) —PSFolderRestService.plainTextErrorruntime-encoding helper.ffbea865fb) —PSAaClientServletreverse-proxy.d869d5672d) —PSAssetRestService/PSSiteDataRestService.3a832e82de) —PSRoleServiceXSS residuals.Notes
*.versionproperties untouched per the Java 8 stack constraint.Version.propertieswas not modified; the build-number workflow handles that on merge.