2021.0：Fix the code analysis error. (#500)

* Fix the code analysis error.

* Upgrade owasp esapi's configuration

* Add information of this PR to CHANGELOG.md

CHANGELOG.md

@@ -13,3 +13,4 @@
 - [Feature: delete implement ServiceInstance](https://github.com/Tencent/spring-cloud-tencent/pull/483)
 - [test: add loadbalancer unit test](https://github.com/Tencent/spring-cloud-tencent/pull/485)
 - [Bugfix: update byte-buddy scope test to compile](https://github.com/Tencent/spring-cloud-tencent/pull/498)
+- [Fix the code analysis error.](https://github.com/Tencent/spring-cloud-tencent/pull/500)

spring-cloud-tencent-examples/polaris-circuitbreaker-example/polaris-circuitbreaker-example-a/pom.xml

@@ -38,6 +38,11 @@
 			<groupId>org.springframework.cloud</groupId>
 			<artifactId>spring-cloud-circuitbreaker-spring-retry</artifactId>
 		</dependency>
+
+		<dependency>
+			<groupId>org.owasp.esapi</groupId>
+			<artifactId>esapi</artifactId>
+		</dependency>
 	</dependencies>
 
     <build>

spring-cloud-tencent-examples/polaris-circuitbreaker-example/polaris-circuitbreaker-example-a/src/main/java/com/tencent/cloud/polaris/circuitbreaker/example/ServiceAController.java

@@ -17,6 +17,8 @@
 
 package com.tencent.cloud.polaris.circuitbreaker.example;
 
+import org.owasp.esapi.ESAPI;
+
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -59,8 +61,15 @@ public class ServiceAController {
 	 */
 	@GetMapping("/testRest")
 	public String testRest() {
-		ResponseEntity<String> entity = restTemplate
+		ResponseEntity<String> entity = restTemplate.getForEntity(
-				.getForEntity("http://polaris-circuitbreaker-example-b/example/service/b/info", String.class);
+				"http://polaris-circuitbreaker-example-b/example/service/b/info",
-		return entity.getBody();
+				String.class);
+		String response = entity.getBody();
+		return cleanXSS(response);
+	}
+
+	private String cleanXSS(String str) {
+		str = ESAPI.encoder().encodeForHTML(str);
+		return str;
 	}
 }

spring-cloud-tencent-examples/polaris-circuitbreaker-example/polaris-circuitbreaker-example-a/src/main/resources/ESAPI.properties

@@ -0,0 +1,14 @@
+ESAPI.printProperties=true
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
+ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
+
+Encoder.AllowMultipleEncoding=false
+Encoder.AllowMixedEncoding=false
+Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec
+
+Logger.LogEncodingRequired=false
+Logger.UserInfo=false
+Logger.ClientInfo=false
+Logger.ApplicationName=ExampleApplication
+Logger.LogApplicationName=false
+Logger.LogServerIP=false

spring-cloud-tencent-examples/polaris-gateway-example/gateway-callee-service/pom.xml

@@ -23,5 +23,10 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>
 		</dependency>
+
+		<dependency>
+			<groupId>org.owasp.esapi</groupId>
+			<artifactId>esapi</artifactId>
+		</dependency>
 	</dependencies>
 </project>

spring-cloud-tencent-examples/polaris-gateway-example/gateway-callee-service/src/main/java/com/tencent/cloud/polaris/gateway/example/callee/GatewayCalleeController.java

@@ -21,6 +21,7 @@ import java.io.UnsupportedEncodingException;
 import java.net.URLDecoder;
 
 import com.tencent.cloud.common.constant.MetadataConstant;
+import org.owasp.esapi.ESAPI;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -66,7 +67,13 @@ public class GatewayCalleeController {
 	public String echoHeader(@RequestHeader(MetadataConstant.HeaderName.CUSTOM_METADATA) String metadataStr)
 			throws UnsupportedEncodingException {
 		LOG.info(URLDecoder.decode(metadataStr, UTF_8));
-		return URLDecoder.decode(metadataStr, UTF_8);
+		metadataStr = URLDecoder.decode(metadataStr, UTF_8);
+		return cleanXSS(metadataStr);
+	}
+
+	private String cleanXSS(String str) {
+		str = ESAPI.encoder().encodeForHTML(str);
+		return str;
 	}
 
 }

spring-cloud-tencent-examples/polaris-gateway-example/gateway-callee-service/src/main/resources/ESAPI.properties

@@ -0,0 +1,14 @@
+ESAPI.printProperties=true
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
+ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
+
+Encoder.AllowMultipleEncoding=false
+Encoder.AllowMixedEncoding=false
+Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec
+
+Logger.LogEncodingRequired=false
+Logger.UserInfo=false
+Logger.ClientInfo=false
+Logger.ApplicationName=ExampleApplication
+Logger.LogApplicationName=false
+Logger.LogServerIP=false

spring-cloud-tencent-examples/polaris-gateway-example/gateway-callee-service2/pom.xml

@@ -23,6 +23,11 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>
 		</dependency>
+
+		<dependency>
+			<groupId>org.owasp.esapi</groupId>
+			<artifactId>esapi</artifactId>
+		</dependency>
 	</dependencies>
 
 </project>

spring-cloud-tencent-examples/polaris-gateway-example/gateway-callee-service2/src/main/java/com/tencent/cloud/polaris/gateway/example/callee/GatewayCalleeController.java

@@ -21,6 +21,7 @@ import java.io.UnsupportedEncodingException;
 import java.net.URLDecoder;
 
 import com.tencent.cloud.common.constant.MetadataConstant;
+import org.owasp.esapi.ESAPI;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -66,7 +67,13 @@ public class GatewayCalleeController {
 	public String echoHeader(@RequestHeader(MetadataConstant.HeaderName.CUSTOM_METADATA) String metadataStr)
 			throws UnsupportedEncodingException {
 		LOG.info(URLDecoder.decode(metadataStr, UTF_8));
-		return URLDecoder.decode(metadataStr, UTF_8);
+		metadataStr = URLDecoder.decode(metadataStr, UTF_8);
+		return cleanXSS(metadataStr);
+	}
+
+	private String cleanXSS(String str) {
+		str = ESAPI.encoder().encodeForHTML(str);
+		return str;
 	}
 
 }

spring-cloud-tencent-examples/polaris-gateway-example/gateway-callee-service2/src/main/resources/ESAPI.properties

@@ -0,0 +1,14 @@
+ESAPI.printProperties=true
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
+ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
+
+Encoder.AllowMultipleEncoding=false
+Encoder.AllowMixedEncoding=false
+Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec
+
+Logger.LogEncodingRequired=false
+Logger.UserInfo=false
+Logger.ClientInfo=false
+Logger.ApplicationName=ExampleApplication
+Logger.LogApplicationName=false
+Logger.LogServerIP=false

spring-cloud-tencent-examples/polaris-router-example/router-callee-service1/pom.xml

@@ -17,6 +17,11 @@
 			<groupId>com.tencent.cloud</groupId>
 			<artifactId>spring-cloud-starter-tencent-polaris-discovery</artifactId>
 		</dependency>
+
+		<dependency>
+			<groupId>org.owasp.esapi</groupId>
+			<artifactId>esapi</artifactId>
+		</dependency>
 	</dependencies>
 
 	<build>

spring-cloud-tencent-examples/polaris-router-example/router-callee-service1/src/main/java/com/tencent/cloud/polaris/router/example/RouterCalleeController.java

@@ -18,6 +18,7 @@
 
 package com.tencent.cloud.polaris.router.example;
 
+import org.owasp.esapi.ESAPI;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -48,7 +49,15 @@ public class RouterCalleeController {
 	@PostMapping("/info")
 	public String info(String name, @RequestBody User user) {
 		LOG.info("Discovery Service Callee [{}] is called.", port);
-		return String.format("Discovery Service Callee [%s] is called. user = %s", port, user);
+		return String.format("Discovery Service Callee [%s] is called. user = %s", port, cleanXSS(user));
+	}
+
+	private User cleanXSS(User user) {
+		User u = new User();
+		String name = ESAPI.encoder().encodeForHTML(user.getName());
+		u.setName(name);
+		u.setAge(user.getAge());
+		return u;
 	}
 
 }

spring-cloud-tencent-examples/polaris-router-example/router-callee-service1/src/main/resources/ESAPI.properties

@@ -0,0 +1,14 @@
+ESAPI.printProperties=true
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
+ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
+
+Encoder.AllowMultipleEncoding=false
+Encoder.AllowMixedEncoding=false
+Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec
+
+Logger.LogEncodingRequired=false
+Logger.UserInfo=false
+Logger.ClientInfo=false
+Logger.ApplicationName=ExampleApplication
+Logger.LogApplicationName=false
+Logger.LogServerIP=false

spring-cloud-tencent-examples/polaris-router-example/router-callee-service2/pom.xml

@@ -17,6 +17,11 @@
 			<groupId>com.tencent.cloud</groupId>
 			<artifactId>spring-cloud-starter-tencent-polaris-discovery</artifactId>
 		</dependency>
+
+		<dependency>
+			<groupId>org.owasp.esapi</groupId>
+			<artifactId>esapi</artifactId>
+		</dependency>
 	</dependencies>
 
 	<build>

spring-cloud-tencent-examples/polaris-router-example/router-callee-service2/src/main/java/com/tencent/cloud/polaris/router/example/RouterCalleeController.java

@@ -18,6 +18,7 @@
 
 package com.tencent.cloud.polaris.router.example;
 
+import org.owasp.esapi.ESAPI;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -49,7 +50,15 @@ public class RouterCalleeController {
 	@PostMapping("/info")
 	public String info(@RequestParam("name") String name, @RequestBody User user) {
 		LOG.info("Discovery Service Callee [{}] is called.", port);
-		return String.format("Discovery Service Callee [%s] is called. user = %s", port, user);
+		return String.format("Discovery Service Callee [%s] is called. user = %s", port, cleanXSS(user));
+	}
+
+	private User cleanXSS(User user) {
+		User u = new User();
+		String name = ESAPI.encoder().encodeForHTML(user.getName());
+		u.setName(name);
+		u.setAge(user.getAge());
+		return u;
 	}
 
 }

spring-cloud-tencent-examples/polaris-router-example/router-callee-service2/src/main/resources/ESAPI.properties

@@ -0,0 +1,14 @@
+ESAPI.printProperties=true
+ESAPI.Encoder=org.owasp.esapi.reference.DefaultEncoder
+ESAPI.Logger=org.owasp.esapi.logging.slf4j.Slf4JLogFactory
+
+Encoder.AllowMultipleEncoding=false
+Encoder.AllowMixedEncoding=false
+Encoder.DefaultCodecList=HTMLEntityCodec,PercentCodec,JavaScriptCodec
+
+Logger.LogEncodingRequired=false
+Logger.UserInfo=false
+Logger.ClientInfo=false
+Logger.ApplicationName=ExampleApplication
+Logger.LogApplicationName=false
+Logger.LogServerIP=false

spring-cloud-tencent-examples/pom.xml

@@ -30,4 +30,14 @@
         <maven.deploy.skip>true</maven.deploy.skip>
     </properties>
 
+	<dependencyManagement>
+		<dependencies>
+			<dependency>
+				<groupId>org.owasp.esapi</groupId>
+				<artifactId>esapi</artifactId>
+				<version>2.1.0.1</version>
+			</dependency>
+		</dependencies>
+	</dependencyManagement>
+
 </project>