hearty veldt
Hi everyone, I was given a task to fix some security alerts with CodeQL and was having a bit of trouble. Would love if someone can help me resolve the alert without making major changes to the code that might break the servers.
Unsafe hostVerifier
HttpsURLConnection.setDefaultHostnameVerifier((hostname, sslSession) -> true)
From what I read the method is use to stop MITM attacks, however the code is only used to ensure that the code runs when all hostVerfiers are in use without being passed a hostname or sslSession. How can I change the code to remove the error and keep that functionality?
Cross-site scripting
public ResponseEnitity<String> tracker(@Requestparam String startDate, @RequestParam endDate){
return new ResponseEntity<>(trackingService.trackingData(startDate, endDate), HttpStatus.OK);
}
ResponseEnitity<String> response = restTemplate.exchange(actualRequest, String.class);
mockWebService.save(actualRequest, endpoint, response);
LOGGER.info("MockResourse.recorder({})->End", endpoint.toString());
return response
Seems like startDate, endDate, and response is giving the error. What the best way to sanitize the input to prevent XSS attacks.
ruby kettle
tight bough