java - Fortify 问题将未经验证的数据发送到 Web 浏览器

Question

我正在创建如下响应:

    @Override
    public Response post(String html,String headers) {
        HttpEntity<String> requestPayload = new HttpEntity<String>(html,headers);
        ResponseEntity<String> responseEntity = null;
        responseEntity = restTemplate.postForEntity(uri, requestPayload,String.class);
        String responseString = responseEntity.getBody().toString();
        return Response.ok().entity(responseString).build();
    }

Fortify 在提示

该方法在第 xx 行向网络浏览器发送未经验证的数据，这可能导致浏览器执行恶意代码。

知道如何解决这个问题吗？

Answer 1

您需要告诉 spring Controller 您需要从后端发送响应的数据格式。

对于 GET 请求，这需要在 Controller 中添加。即，

produces = MediaType.APPLICATION_JSON_VALUE
@RequestMapping(value = "/Patient/{patientID}/_history/{versionId}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)

对于POST请求produces & consumes需要添加

@RequestMapping(value = "/Patient", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE, consumes = MediaType.APPLICATION_JSON_VALUE)

@Override
@RequestMapping(value = "/Patient/{patientID}/_history/{versionId}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<PhoenixResponse> getResourceByVersionId(@PathVariable String patientID, @PathVariable String versionId) {
    return super.getResourceByVersionId(patientID, versionId);
}