Java SonarQube: Error This use of java/io/PrintWriter.write(Ljava/lang/String;)V could be vulnerable to XSS

Question

I am getting this error below. When using ResponseWriter. How can I resolve it? Goal is to resolve the Sonarqube error, however my proposed solution below using Sonar documentation isn't working.

try {
   unifiedResponse = testController.updateData(testRequest);
} catch (RestClientResponseException e) {
    try {
        PrintWriter writer = response.getWriter();
        response.setContentType(MediaType.TEXT_PLAIN);
        response.setStatus(e.getRawStatusCode());
        writer.print(e.getResponseBodyAsString());
    } catch (IOException ex) {
        throw new ServiceException("Cannot get update Password error response body", ex);
    }
}

Error:

This use of java/io/PrintWriter.write(Ljava/lang/String;)V could be vulnerable to XSS

My output is JSON, HTMLEscape and OWASP creates bad formatting, which I need.

{ 
    "message": "Here is a test message"
}

OWASP Output:

{"message":"Here is a test message (e.g. !@#$)."}

SonarQube Rules:

I tried SonarQube official solution and still giving error. https://rules.sonarsource.com/java/RSPEC-5131/

Answer 1

You have:

response.setContentType(MediaType.TEXT_PLAIN);
writer.print(e.getResponseBodyAsString());

That looks dangerous, especially if the response is the string "message": "<script>alert('Hacked!');</script>"!

Essentially, whenever you output data directly to a browser (in this case via PrintWriter), if that data contains malicious scripts from user input or any non-trusted sources, it can be executed on the client side, leading to Cross-Site Scripting (XSS) attacks.

If you know you want a JSON content, specify it explicitly:

response.setContentType(MediaType.APPLICATION_JSON);

And always escape the data before sending it as output. You mentioned that HTMLEscape causes bad formatting. That makes sense because you are working with JSON. Instead of HTML escaping, you should try and use JSON escaping, with, for instance, FasterXML/jackson. See Reading and Writing Using ObjectMapper from Eugen Baeldung.

String jsonEscaped = new ObjectMapper().writeValueAsString(e.getResponseBodyAsString());
writer.print(jsonEscaped);

With you pom.xml including in the <dependencies> section:

<dependency>
    <groupId>com.fasterxml.jackson.core</groupId>
    <artifactId>jackson-databind</artifactId>
    <version>2.15.2</version>
</dependency>

Your code would then would be:

import com.fasterxml.jackson.databind.ObjectMapper;
...
try {
    unifiedResponse = testController.updateData(testRequest);
} catch (RestClientResponseException e) {
    try {
        PrintWriter writer = response.getWriter();
        response.setContentType(MediaType.APPLICATION_JSON);

        // Avoid directly printing exception. Instead, you can log it.
        // log.error("Error occurred", e);
        
        // Send a generic error message or a sanitized version of the actual error message.
        String sanitizedOutput = new ObjectMapper().writeValueAsString(Collections.singletonMap("error", "An error occurred."));
        writer.print(sanitizedOutput);

    } catch (IOException ex) {
        throw new ServiceException("Cannot get update Password error response body", ex);
    }
}

Answer 2

An XSS vulnerability usually means that there is an unbroken connection of data from the request back to the response. The easiest solution for this is usually just to use a library like StringEscapeUtils.escapeHtml4 on the data coming from the request. That would make it so that a tag (the real root of all XSS attacks) would be converted to <script%gt; which would render on the screen as but would not execute in the browser as script. Hopefully that makes sense.

Answer 3

Some time ago I wrote an answer that could be of help: it is not related to the SonarQube error, but on how to adapt the error messages returned by RestTemplate.

The idea is configuring RestTemplate to use a custom ResponseErrorHandler. Adapted from the answer:

import java.io.IOException;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;

import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpStatus;
import org.springframework.http.client.ClientHttpResponse;
import org.springframework.lang.Nullable;
import org.springframework.util.ObjectUtils;
import org.springframework.web.client.DefaultResponseErrorHandler;
import org.springframework.web.client.HttpClientErrorException;
import org.springframework.web.client.HttpServerErrorException;
import org.springframework.web.client.UnknownHttpStatusCodeException;

public class CustomRestTemplateResponseErrorHandler extends DefaultResponseErrorHandler {
  
  // This overloaded method version is only available since Spring 5.0
  // For previous versions of the library you can override
  // handleError(ClientHttpResponse response) instead
  @Override
  protected void handleError(ClientHttpResponse response, HttpStatus statusCode) throws IOException {
    String statusText = response.getStatusText();
    HttpHeaders headers = response.getHeaders();
    byte[] body = getResponseBody(response);
    Charset charset = getCharset(response);
    String message = getErrorMessage(statusCode.value(), statusText, body, charset);

    switch (statusCode.series()) {
      case CLIENT_ERROR:
        throw HttpClientErrorException.create(message, statusCode, statusText, headers, body, charset);
      case SERVER_ERROR:
        throw HttpServerErrorException.create(message, statusCode, statusText, headers, body, charset);
      default:
        throw new UnknownHttpStatusCodeException(message, statusCode.value(), statusText, headers, body, charset);
    }
  }

  /**
   * Return error message with details from the response body:
   * <pre>
   * 404 Not Found: [{'id': 123, 'message': 'actual mesage']
   * </pre>
   *
   * In contrast to <code>DefaultResponseErrorHandler</code>, the message will not be truncated.
   */
  private String getErrorMessage(
      int rawStatusCode, String statusText, @Nullable byte[] responseBody, @Nullable Charset charset) {

    // Build and return your custom json error message here
  }
}

Then, configure RestTemplate to use this custom ResponseErrorHandler:

RestTemplate restTemplate = new RestTemplate();
ResponseErrorHandler errorHandler = new CustomRestTemplateResponseErrorHandler();
restTemplate.setErrorHandler(errorHandler);
// use your RestTemplate normally

Please, as also stated in the mentioned answer, consider read this related SO question and this or this related blog posts.

Using this approach the returned error should be properly formatted without the need of using PrintWriter directly, Spring will take care of everything to return this message to the client in a proper way without any SonarQube issue.

Sometimes resolving a SonarQube rule validation error could be cornerstone: in this specific use case, if you are sure that the information returned is safe, you can probably ignoring it. In any case, to avoid any potential problem, be sure that your client sanitizes the returned information when you use it using the means provided by the actual framework you are using.