← All recipes
Moderne licensed

Fix XSS vulnerabilities in Java sources

Recipe IDorg.openrewrite.analysis.java.security.FixXssVulnerabilityJava
Artifactio.moderne.recipe:rewrite-program-analysis

Wraps tainted arguments flowing into HTML output sinks with an HTML-escape helper. Reuses FindXssVulnerability's taint spec so the fix's source/sink/sanitizer coverage stays in sync with the detector. The escape helper is picked per JavaProject based on which dependency is declared (direct or transitive) in the project's Maven or Gradle build, preferring Spring HtmlUtils (org.springframework:spring-web), then OWASP Encode (org.owasp.encoder:encoder), then Commons Text (org.apache.commons:commons-text), then deprecated Commons Lang3 (org.apache.commons:commons-lang3). Projects with no recognised helper dependency are skipped; arguments already wrapped in a recognised sanitizer are also skipped. For detection without remediation, use FindXssVulnerability directly.

Single recipeProprietary

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe org.openrewrite.analysis.java.security.FixXssVulnerabilityJava

If the recipe isn’t available locally, install it with:

mod config recipes jar install io.moderne.recipe:rewrite-program-analysis:0.13.7

Data tables

Structured output this recipe can produce.

  • Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
  • Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
  • Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
  • Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats