eclipse-ee4j / eclipse-ee4j/jersey

Extend class FormDataMultiPart for XSS protection

Open
#5,140 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
730
Forks
382
PR merge metrics
No merged PRs in 30d

Description

I m working on adding XSS protection to my project. For FromData requests, the request body is still not readable (InputStream) in the Filter stage. So I want to add sanitization after InputStream gets parsed to MessageBody and server to Controller.

I tried to create XSSFormDataMultiPart class that extends FormDataMultiPart, but Jersey complains that there is no MessageBodayReader for XSSFormDataMultiPart.

Here is my current approach:
1. I created a MessageBodyReader that basically copies all the code from MultiPartReaderClientSide,
`public class XssMultiPartMessageBodyReader implements MessageBodyReader`
2. Created XSSFormDataMultiPart that extends class MultiPart. then add sanitization code in XSSFormDataMultiPart.
`public class XssFormDataMultiPart extends MultiPart `
3. Replace FormDataMultiPart with XSSFormDataMultiPart in Controller.

I am just wondering if there is any better solution. Since I copied code from MultiPartReaderClientSide and FormDataMultiPart, if these files get updated in a later version, my code could be outdated.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.