Fix the code analysis error.

[pandaapo]

PR Type

Describe what this PR does for and how you did.

Fix the code analysis error： (1) Append the missing space in string literal. (2) Using Filter and @ControllerAdvice to guard against cross-site scripting.

Adding the issue link (#xxx) if possible.

#462

Note

Checklist

• Add copyright holder at the beginning of .class file if it is new.
• Add information of this PR to CHANGELOG.md in root of project.
• All junit tests passing.
• Coverage from Codecov Report should not decrease.

Checklist (Optional)

• Will Pull Request to branch of 2020.0 and 2021.0.
• Add documentation in javadoc in code or comment below the PR if necessary.
• Add your name as @author to the beginning of .class file.

[SkyeBeFreeman]

@pandaapo there are some cheskstyle error in you PR. Run mvn clean test before you pushing the commit.

[pandaapo]

@pandaapo there are some cheskstyle error in you PR. Run mvn clean test before you pushing the commit.

Running mvn clean test once takes a long time! Having run many times today but not yet complete.
Is there a way to get or apply all the checkstyle rules in advance? If yes I can find errors when coding.

[SkyeBeFreeman]

@pandaapo there are some cheskstyle error in you PR. Run mvn clean test before you pushing the commit.

Running mvn clean test once takes a long time! Having run many times today but not yet complete. Is there a way to get or apply all the checkstyle rules in advance? If yes I can find errors when coding.

You can configure plugin in IDEA following the doc from Spring Cloud 代码规范.

[SkyeBeFreeman]

Click "Resolve conversation" after you having fixed that.

[lgtm-com]

This pull request fixes 1 alert when merging c74c380 into 4ed19e2 - view on LGTM.com

fixed alerts:

• 1 for Missing space in string literal

[SkyeBeFreeman]

This pull request fixes 1 alert when merging c74c380 into 4ed19e2 - view on LGTM.com

fixed alerts:

• 1 for Missing space in string literal

@pandaapo This doesn't look like it fixes the cross site issue？Check here for solution Cross-site scripting
.

[pandaapo]

This pull request fixes 1 alert when merging c74c380 into 4ed19e2 - view on LGTM.com
fixed alerts:

• 1 for Missing space in string literal

@pandaapo This doesn't look like it fixes the cross site issue？Check here for solution Cross-site scripting .

I used Filter to handle the request, and ResponseBodyAdvice to handle the Response. Does it not work?

[SkyeBeFreeman]

This pull request fixes 1 alert when merging c74c380 into 4ed19e2 - view on LGTM.com
fixed alerts:

• 1 for Missing space in string literal

@pandaapo This doesn't look like it fixes the cross site issue？Check here for solution Cross-site scripting .

I used Filter to handle the request, and ResponseBodyAdvice to handle the Response. Does it not work?

Maybe should change a new method to fix this.

[pandaapo]

This pull request fixes 1 alert when merging c74c380 into 4ed19e2 - view on LGTM.com
fixed alerts:

• 1 for Missing space in string literal

@pandaapo This doesn't look like it fixes the cross site issue？Check here for solution Cross-site scripting .

I used Filter to handle the request, and ResponseBodyAdvice to handle the Response. Does it not work?

Maybe should change a new method to fix this.

• Can I use the simple and straightforward but not very good method? for example, escape data directly in the body of each method that has alerts.

• Can I test code that fixes XSS with LGTM.com before pushing my commits?
  I find a single-use way : Because the LGTM.com doesn't support analysis of fork, I must create a new repository on github that is same as my current fork. Then test code with LGTM.com.

[SkyeBeFreeman]

This pull request fixes 1 alert when merging c74c380 into 4ed19e2 - view on LGTM.com
fixed alerts:

• 1 for Missing space in string literal

@pandaapo This doesn't look like it fixes the cross site issue？Check here for solution Cross-site scripting .

I used Filter to handle the request, and ResponseBodyAdvice to handle the Response. Does it not work?

Maybe should change a new method to fix this.

• Can I use the simple and straightforward but not very good method? for example, escape data directly in the body of each method that has alerts.
• Can I test code that fixes XSS with LGTM.com before pushing my commits?
  I find a single-use way : Because the LGTM.com doesn't support analysis of fork, I must create a new repository on github that is same as my current fork. Then test code with LGTM.com.

Try the second method. If the implementation is complicated or difficult to implement, then use the first method.

[lgtm-com]

This pull request fixes 1 alert when merging 58ae9a5 into a91a380 - view on LGTM.com

fixed alerts:

• 1 for Missing space in string literal

[SkyeBeFreeman]

This pull request fixes 1 alert when merging 58ae9a5 into a91a380 - view on LGTM.com

fixed alerts:

• 1 for Missing space in string literal

@pandaapo It seems that every commit will trigger LGTM.com analyzing.

[lgtm-com]

This pull request fixes 6 alerts when merging a7d0f1d into a91a380 - view on LGTM.com

fixed alerts:

• 5 for Cross-site scripting
• 1 for Missing space in string literal

[lgtm-com]

This pull request fixes 6 alerts when merging d9d0352 into a91a380 - view on LGTM.com

fixed alerts:

• 5 for Cross-site scripting
• 1 for Missing space in string literal

[SkyeBeFreeman]

@pandaapo You can cherry-pick this PR to branch 2020 and 2021. It will be in version 1.8.0. I will merge it after version 1.7.0 of 2020 and 2021 is released.

[SkyeBeFreeman]

@pandaapo You should fix these error before you cherry-pick to other branches.
Cross-site Scripting in org.owasp.esapi:esapi
Path traversal in the OWASP Enterprise Security API

[SkyeBeFreeman]

@pandaapo You should fix these error before you cherry-pick to other branches. Cross-site Scripting in org.owasp.esapi:esapi Path traversal in the OWASP Enterprise Security API

@pandaapo I have used dependabot to fix this in main branch. If you cherry-pick to 2020 and 2021 branch, you should check the dependency version before you pushing your commit.

[pandaapo]

@pandaapo You should fix these error before you cherry-pick to other branches. Cross-site Scripting in org.owasp.esapi:esapi Path traversal in the OWASP Enterprise Security API

@pandaapo I have used dependabot to fix this in main branch. If you cherry-pick to 2020 and 2021 branch, you should check the dependency version before you pushing your commit.

I have done as you said.