eclipse-ee4j / eclipse-ee4j/jersey
Extend class FormDataMultiPart for XSS protection
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
I m working on adding XSS protection to my project. For FromData requests, the request body is still not readable (InputStream) in the Filter stage. So I want to add sanitization after InputStream gets parsed to MessageBody and server to Controller.
I tried to create XSSFormDataMultiPart class that extends FormDataMultiPart, but Jersey complains that there is no MessageBodayReader for XSSFormDataMultiPart.
Here is my current approach:
1. I created a MessageBodyReader that basically copies all the code from MultiPartReaderClientSide,
`public class XssMultiPartMessageBodyReader implements MessageBodyReader`
2. Created XSSFormDataMultiPart that extends class MultiPart. then add sanitization code in XSSFormDataMultiPart.
`public class XssFormDataMultiPart extends MultiPart `
3. Replace FormDataMultiPart with XSSFormDataMultiPart in Controller.
I am just wondering if there is any better solution. Since I copied code from MultiPartReaderClientSide and FormDataMultiPart, if these files get updated in a later version, my code could be outdated.
Contributor guide
Assessment
This issue has not been assessed yet.