Skip to content

refactor(calm-hub): use centralized strict sanitization policy to prevent XSS #1859

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rocketstack-matt wants to merge 2 commits into from
+45 −2
Closed

refactor(calm-hub): use centralized strict sanitization policy to prevent XSS #1859

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
80a0aaa
fix(calm-hub): use centralized strict sanitization policy to prevent XSS
rocketstack-matt Nov 27, 2025
f4b38f1
refactor(tests): update method names for consistency and readability
rocketstack-matt Nov 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions calm-hub/src/main/java/org/finos/calm/resources/CoreSchemaResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
import org.finos.calm.security.CalmHubScopes;
import org.finos.calm.security.PermittedScopes;
import org.finos.calm.store.CoreSchemaStore;
import org.owasp.html.HtmlPolicyBuilder;

import org.owasp.html.PolicyFactory;

import java.net.URI;
Expand All @@ -25,7 +25,7 @@
@Path("/calm/schemas")
public class CoreSchemaResource {

private static final PolicyFactory STRICT_SANITIZATION_POLICY = new HtmlPolicyBuilder().toFactory();
private static final PolicyFactory STRICT_SANITIZATION_POLICY = ResourceValidationConstants.STRICT_SANITIZATION_POLICY;
Copy link

Copilot AI Nov 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Consider using a static import for STRICT_SANITIZATION_POLICY instead of creating a local constant that references it. This would be more consistent with how PatternResource uses the same constant (see line 26 of PatternResource.java).

Current approach:

private static final PolicyFactory STRICT_SANITIZATION_POLICY = ResourceValidationConstants.STRICT_SANITIZATION_POLICY;

Suggested approach:

import static org.finos.calm.resources.ResourceValidationConstants.STRICT_SANITIZATION_POLICY;

This would eliminate the redundant local constant and align with the existing codebase pattern.

Copilot uses AI. Check for mistakes.

private final CoreSchemaStore coreSchemaStore;

Expand Down
43 changes: 43 additions & 0 deletions calm-hub/src/test/java/org/finos/calm/resources/TestSanitizationSecurityShould.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,43 @@
package org.finos.calm.resources;

import org.junit.jupiter.api.Assertions;
import org.junit.jupiter.api.Test;
import org.owasp.html.PolicyFactory;

public class TestSanitizationSecurityShould {

@Test
public void withstandNoscriptStyleInjectionAttack() {
Copy link

Copilot AI Nov 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Test method names in this codebase use snake_case rather than camelCase. Consider renaming to withstand_noscript_style_injection_attack for consistency with other test files like TestCoreSchemaResourceShould, TestArchitectureResourceShould, and even domain tests like TestDecisionShould.

Suggested change
public void withstandNoscriptStyleInjectionAttack() {
public void withstand_noscript_style_injection_attack() {

Copilot uses AI. Check for mistakes.
// This test verifies the fix for the specific vulnerability where allowTextIn("style")
// combined with noscript tags could lead to XSS.
// The application uses a strict policy that should NOT be vulnerable.

PolicyFactory policy = ResourceValidationConstants.STRICT_SANITIZATION_POLICY;

String pocPayload1 = "<noscript><style></noscript><script>alert(1)</script>";
String sanitized1 = policy.sanitize(pocPayload1);

// The strict policy (default factory) should strip everything not whitelisted.
// Since nothing is whitelisted, it should ideally be empty or just text content if any remains valid text.
// But definitively NO <script> tags should survive.
Assertions.assertFalse(sanitized1.contains("<script>"), "Sanitized output should not contain script tags: " + sanitized1);
Assertions.assertFalse(sanitized1.contains("alert(1)"), "Sanitized output should not contain executable code: " + sanitized1);

String pocPayload2 = "<p><style></p><script>alert(1)</script>";
String sanitized2 = policy.sanitize(pocPayload2);
Assertions.assertFalse(sanitized2.contains("<script>"), "Sanitized output should not contain script tags: " + sanitized2);
Assertions.assertFalse(sanitized2.contains("alert(1)"), "Sanitized output should not contain executable code: " + sanitized2);
}

@Test
public void actAsStrictPolicy() {
Copy link

Copilot AI Nov 27, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[nitpick] Test method names in this codebase use snake_case rather than camelCase. Consider renaming to act_as_strict_policy for consistency with other test files.

Suggested change
public void actAsStrictPolicy() {
public void act_as_strict_policy() {

Copilot uses AI. Check for mistakes.
PolicyFactory policy = ResourceValidationConstants.STRICT_SANITIZATION_POLICY;

String input = "<div><b>bold</b><script>alert('xss')</script></div>";
String output = policy.sanitize(input);

// Default builder().toFactory() allows NO elements.
// So it should strip all tags.
Assertions.assertEquals("bold", output, "Strict policy should strip all tags");
}
}
Loading