Fortify issue sends unvalidated data to a web browser

Question

I am creating response as below:

    @Override
    public Response post(String html,String headers) {
        HttpEntity<String> requestPayload = new HttpEntity<String>(html,headers);
        ResponseEntity<String> responseEntity = null;
        responseEntity = restTemplate.postForEntity(uri, requestPayload,String.class);
        String responseString = responseEntity.getBody().toString();
        return Response.ok().entity(responseString).build();
    }

Fortify is complaining

The method sends unvalidated data to a web browser on line xx, which can result in the browser executing malicious code.

Any idea how can I fix this?

Answer 1

You need to tell the spring controller that what format of data you would need to send a response from the back end.

For GET Request this needs to be added in controller. i.e.,

produces = MediaType.APPLICATION_JSON_VALUE
@RequestMapping(value = "/Patient/{patientID}/_history/{versionId}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)

For POST request produces & consumes needs to be added

@RequestMapping(value = "/Patient", method = RequestMethod.POST, produces = MediaType.APPLICATION_JSON_VALUE, consumes = MediaType.APPLICATION_JSON_VALUE)

@Override
@RequestMapping(value = "/Patient/{patientID}/_history/{versionId}", method = RequestMethod.GET, produces = MediaType.APPLICATION_JSON_VALUE)
public ResponseEntity<PhoenixResponse> getResourceByVersionId(@PathVariable String patientID, @PathVariable String versionId) {
    return super.getResourceByVersionId(patientID, versionId);
}

Answer 2

In PHP I had same problem I changed the code from :

 $output = array(
        "draw" =>  (isset($requestData['draw']) ? $requestData['draw']:1),
        "recordsTotal" => intval($totalData),
        "recordsFiltered" => intval($filteredData),
        "data" => $data
    );

    echo json_encode($output);

To:

if (isset ( $requestData ['draw'] )) {
            $draw = $requestData ['draw'];
        } else {
            $draw = 1;
        }
$output = array (
            "draw" => intval ( $requestData ['draw'] ),
            "recordsTotal" => intval ( $totalData ),
            "recordsFiltered" => intval ( $filteredData ),
            "data" => $data
    );
    echo json_encode ( $output );

and I solve the problem :-) I hope that this help someone!