Add SSTI, stored XSS, and SSRF vulnerability modules with Kotlin support#7
Add SSTI, stored XSS, and SSRF vulnerability modules with Kotlin support#7misonijnik wants to merge 1 commit intodemo/basefrom
Conversation
Introduce template injection patterns (FreeMarker/Thymeleaf), cross-endpoint stored XSS flows with column-level sensitivity, SSRF via coroutine-based URL fetch, and JPA persistence layer with H2. Update README to document all vulnerability patterns and the expanded tech stack.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| model.put("campaignId", name); | ||
|
|
||
| StringWriter output = new StringWriter(); | ||
| template.process(model, output); |
Check failure
Code scanning / OpenTaint
Unvalidated user data flows into template engine Error
| Context context = new Context(); | ||
| context.setVariable("appName", "Demo Application"); | ||
|
|
||
| return templateEngine.process(templateContent, context); |
Check failure
Code scanning / OpenTaint
Unvalidated user data flows into template engine Error
| return ResponseEntity.ok() | ||
| .contentType(MediaType.TEXT_HTML) | ||
| .body(content); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
| return ResponseEntity.ok() | ||
| .contentType(MediaType.TEXT_HTML) | ||
| .body(title); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
| return ResponseEntity.ok() | ||
| .contentType(MediaType.TEXT_HTML) | ||
| .body(content); |
Check failure
Code scanning / OpenTaint
Potential cross-site scripting (XSS) Error
|
|
||
| scope.launch { | ||
| try { | ||
| val connection = URI.create(url).toURL().openConnection() |
Check failure
Code scanning / OpenTaint
Potential server-side request forgery (SSRF) Error
2 participants
Introduce template injection patterns (FreeMarker/Thymeleaf), cross-endpoint stored XSS flows with column-level sensitivity, SSRF via coroutine-based URL fetch, and JPA persistence layer with H2. Update README to document all vulnerability patterns and the expanded tech stack.