codeql: close java/http-response-splitting #504-#518 (Task 8) - #48
Merged
Conversation
15 alerts, all fixed with runtime CR/LF strips + path-level residuals: Runtime strips (defense in depth): - PSSecurityFilter Set-Cookie session id: stripAllLineBreaks - PSAppServlet outputHeaders: stripAllLineBreaks on key+value - PSPropFindMethod Content-Location: stripAllLineBreaks on URI - PSLockMethod Lock-Token: stripAllLineBreaks on virtual path - PSTemplateServlet Content-Disposition: stripAllLineBreaks on name - 8 delivery-tier XSRF-TOKEN sinks: inline replaceAll CR/LF strip on cookie value before setHeader GHAS does not model stripAllLineBreaks as a sanitizer (PSTemplateInfo and PSSiteImportLogViewer already carried strips and remain flagged on main), so all 15 files are added to paths-ignore in codeql-config.yml + 15 suppressions.md rows, per the PR #33/#35/#36 convention. No 004 reference for this rule family; CWE-113 strip-before-write pattern applied. verify-suppressions.py: PASS (0 warnings). # Please enter the commit message for your changes. Lines starting # with '#' will be kept; you may remove them yourself if you want to. # An empty message aborts the commit. # # interactive rebase in progress; onto 76f4ae3 # Last command done (1 command done): # pick 3c2afc1333 codeql: close java/http-response-splitting #504-#518 (Task 8) # No commands remaining. # You are currently rebasing branch 'codeql/http-response-splitting-2' on '76f4ae3e0f'. # # Changes to be committed: # modified: .github/codeql/codeql-config.yml # modified: CHANGELOG.md # modified: deliverytiersuite/delivery-tier-suite/comments/src/main/java/com/percussion/delivery/comments/services/PSCommentsRestService.java # modified: deliverytiersuite/delivery-tier-suite/feeds/src/main/java/com/percussion/delivery/feeds/services/PSFeedService.java # modified: deliverytiersuite/delivery-tier-suite/forms/src/main/java/com/percussion/delivery/forms/impl/PSFormRestService.java # modified: deliverytiersuite/delivery-tier-suite/integrations/src/main/java/com/percussion/delivery/integrations/IntegrationsRestService.java # modified: deliverytiersuite/delivery-tier-suite/membership/src/main/java/com/percussion/membership/services/impl/PSMembershipRestService.java # modified: deliverytiersuite/delivery-tier-suite/metadata/src/main/java/com/percussion/delivery/metadata/impl/PSMetadataExtractorRestService.java # modified: deliverytiersuite/delivery-tier-suite/metadata/src/main/java/com/percussion/delivery/metadata/impl/PSMetadataRestService.java # modified: deliverytiersuite/delivery-tier-suite/polls/src/main/java/com/percussion/delivery/polls/services/PSPollsRestService.java # modified: projects/sitemanage/src/main/java/com/percussion/pagemanagement/service/impl/PSTemplateServlet.java # modified: system/servlet/src/com/percussion/webdav/method/PSLockMethod.java # modified: system/servlet/src/com/percussion/webdav/method/PSPropFindMethod.java # modified: system/src/main/java/com/percussion/servlets/PSAppServlet.java # modified: system/src/main/java/com/percussion/servlets/PSSecurityFilter.java #
4 tasks
Collaborator
Author
|
Superseded by #50 (consolidated onto current |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes 15 CodeQL
java/http-response-splittingalerts (#504-#518) with runtime CR/LF strips + path-level residuals.Runtime strips (defense in depth)
PSSecurityFilterSet-Cookie session idstripAllLineBreaksPSAppServletoutputHeadersstripAllLineBreakson key+valuePSPropFindMethodContent-LocationstripAllLineBreakson URIPSLockMethodLock-TokenstripAllLineBreakson virtual pathPSTemplateServletContent-DispositionstripAllLineBreakson templateNamereplaceAll("[\\r\\n]", "")on cookie value beforesetHeaderPSTemplateInfo (#512) and PSSiteImportLogViewer (#514) already carried strips.
Path-level residuals (15 files)
GHAS does not model
stripAllLineBreaksas a sanitizer — the two pre-existing stripped sinks remain flagged on main — and ignores// codeqlcomments. All 15 files are added topaths-ignorein.github/codeql/codeql-config.ymlwith 15 matchingsuppressions.mdrows, per the PR #33/#35/#36 convention.Verification
Notes
Version.propertieswas not modified.