ApiOriginFilter templates ship wildcard CORS (Access-Control-Allow-Origin: *) by default — CWE-942

Summary

The ApiOriginFilter.mustache templates for the JAX-RS and Java MSF4J generators install a Servlet Filter that sets Access-Control-Allow-Origin: * unconditionally on every response. Every JAX-RS / MSF4J server scaffolded by openapi-generator inherits this default and ships with permissive CORS out of the box.

Affected template files

• modules/openapi-generator/src/main/resources/JavaJaxRS/ApiOriginFilter.mustache
• modules/openapi-generator/src/main/resources/JavaJaxRS/resteasy/ApiOriginFilter.mustache
• modules/openapi-generator/src/main/resources/java-msf4j-server/ApiOriginFilter.mustache

Template body (JavaJaxRS):

```java
public class ApiOriginFilter implements {{javaxPackage}}.servlet.Filter {
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
HttpServletResponse res = (HttpServletResponse) response;
res.addHeader("Access-Control-Allow-Origin", "*"); // ← wildcard CORS
res.addHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, PUT");
res.addHeader("Access-Control-Allow-Headers", "Content-Type");
chain.doFilter(request, response);
}
...
}
```

Risk

A wildcard Access-Control-Allow-Origin: * lets any web origin make cross-origin reads of API responses. In combination with credentialed requests (cookies / Authorization headers) this is typically harmless because browsers reject * with credentials, but it still:

1. Defeats same-origin protection for unauthenticated APIs that expose sensitive data.
2. Sets the wrong precedent for downstream users who frequently add Access-Control-Allow-Credentials: true later without realising the wildcard then becomes unsafe.
3. Generated samples (samples/server/petstore/jaxrs-jersey/.../ApiOriginFilter.java, etc.) ship this code as canonical reference — encouraging copy/paste into production.

Suggested fix

Three options:

1. Configurable origin list with safe default: take an allowlist from a Mustache variable / config, default to a single origin (http://localhost:3000) or empty (no filter).
2. Reflect the request Origin against an allowlist: read request.getHeader("Origin"), compare against a config-driven list, only echo on match.
3. Document and warn: keep template as-is but emit a // TODO: replace wildcard with allowlist before production comment.

(1) or (2) is preferred; (3) is the minimum.

Severity

Low–moderate. Wildcard CORS alone is not a confidentiality breach for credentialed APIs (browser-enforced), but it sets a poor default and propagates to every JAX-RS / MSF4J server generated by this tool. Worth fixing at the template once.

Discovery

Found while running an LLM-assisted SAST sweep over the top 100 starred Java repositories on GitHub. Filed alongside other upstream reports from the same sweep (baomidou/mybatis-plus#7091, languagetool-org/languagetool#12041, plantuml/plantuml#2759). Happy to send a PR with the allowlist-based template if maintainers agree on the direction.

Read the three named ApiOriginFilter.mustache templates first and compare how each generated filter currently applies CORS headers. Done means the JAX-RS and MSF4J templates use one agreed safe behavior rather than unconditionally emitting wildcard CORS, consistently across all three files.