How to sanitize and validate user input to pass a Checkmarx scan

Question

I have an endpoint that receives a String from the client as seen below:

@GET
@Path("/{x}")
public Response doSomething(@PathParam("x") String x) {
    String y = myService.process(x);
    return Response.status(OK).entity(y).build();
}

Checkmarx complains that this element’s value then "flows through the code without being properly sanitized or validated and is eventually displayed to the user in method doSomething"

Then I tried this:

@GET
@Path("/{x}")
public Response doSomething(@PathParam("x") String x) {
    if (StringUtils.trimToNull(x) == null || x.length() > 100) { 
        throw new RuntimeException(); 
    }
    x = x.replace("'", "").replace("`", "").replace("\\", "").replace("\"", "")
    String y = myService.process(x);
    y = y.replace("'", "").replace("`", "").replace("\\", "").replace("\"", "")
    return Response.status(OK).entity(y).build();
}

But it still considers this a high severity vulnerability.

How do I properly sanitize or validate to pass a Checkmarx scan?

I am facing the same issue and even after trying y =HtmlUtils.htmlEscape(x) — TomJava, May 29 '20 at 08:15

cahen · Accepted Answer · 2019-05-14T10:06:30.663

17

HtmlUtils from spring-web got the job done with:

HtmlUtils.htmlEscape(x)

Maven dependency:

<dependency>
    <groupId>org.springframework</groupId>
    <artifactId>spring-web</artifactId>
    <version>5.1.7.RELEASE</version>
</dependency>

edited May 14 '19 at 10:06

answered Aug 13 '15 at 11:37

cahen

15,807
13
47
78

it worked for me , my issue is sonar is giving XSS issue on the input of type String for one of the method in controller class , i did leading trailing whitepsaces ,but still issue is present , so i used HtmlUtils.htmlEscape and it worked fine for me – Bravo Dec 26 '19 at 05:43
Does this work only with Spring 5? I tried adding to the path parameter string. But I still get the same issue in check marx – TomJava May 28 '20 at 22:31

score 3 · Answer 2 · edited Feb 01 '19 at 09:34

3

in .Net framework > 4.0 use AntiXSS

AntiXssEncoder.HtmlEncode()

edited Feb 01 '19 at 09:34

cahen

15,807
13
47
78

answered Jan 31 '19 at 21:18

Jeyaganesh

1,334
5
26
48

it has to be applied to property by property or some common way to achieve this? – ManirajSS Nov 15 '21 at 05:39

How to sanitize and validate user input to pass a Checkmarx scan

2 Answers2

Linked