Java local bucketing changes by kaushalkapasi · Pull Request #15 · DevCycleHQ/java-server-sdk

kaushalkapasi · 2022-08-29T20:19:37Z

No description provided.

split current java sdk into common and cloud folders

…t behaviour going forward

add DVCClient class to be used for local bucketing

sonatype-lift · 2022-08-29T20:26:38Z

@@ -1 +1,3 @@
-rootProject.name = "java-server-sdk-example-app"
+rootProject.name = "java-server-sdk-example-app"


Critical Vulnerability:

pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.0

1 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components

pkg:maven/org.springframework/spring-web@5.3.20

CRITICAL Vulnerabilities (1)

Deserialization of Untrusted Data

Pivotal Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data. Depending on how the library is implemented within a product, this issue may or not occur, and authentication may be required. NOTE: the vendor's position is that untrusted data is not an intended use case. The product's behavior will not be changed because some users rely on deserialization of trusted data.

CVSS Score: 9.8

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-502

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2022-08-29T20:26:39Z

CVE-2019-11358

@@ -1 +1,3 @@
-rootProject.name = "java-server-sdk-example-app"
+rootProject.name = "java-server-sdk-example-app"


Severe Vulnerability:

pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.7.0

0 Critical, 5 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components

pkg:maven/org.unbescape/unbescape@1.1.6.RELEASE

SEVERE Vulnerabilities (5)

sonatype-2014-0026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS Score: 6.5

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE: CWE-79

CVE-2019-11358

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-1321

CVE-2020-11023

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

sonatype-2020-0187

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

CVE-2021-23413

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g proto, toString, etc) results in a returned object with a modified prototype instance.

CVSS Score: 5.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-1321

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2022-08-29T20:26:40Z

CVE-2019-11358

@@ -1 +1,3 @@
-rootProject.name = "java-server-sdk-example-app"
+rootProject.name = "java-server-sdk-example-app"


Severe Vulnerability:

pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.7.0

0 Critical, 4 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components

pkg:maven/org.thymeleaf.extras/thymeleaf-extras-java8time@3.0.4.RELEASE

SEVERE Vulnerabilities (4)

CVE-2019-11358

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-1321

CVE-2020-11023

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

sonatype-2020-0187

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

CVE-2021-23413

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g proto, toString, etc) results in a returned object with a modified prototype instance.

CVSS Score: 5.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-1321

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2022-08-29T20:26:42Z

CVE-2019-11358

@@ -1 +1,3 @@
-rootProject.name = "java-server-sdk-example-app"
+rootProject.name = "java-server-sdk-example-app"


Severe Vulnerability:

pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.7.0

0 Critical, 5 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components

pkg:maven/org.attoparser/attoparser@2.0.5.RELEASE

SEVERE Vulnerabilities (5)

sonatype-2014-0026

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS Score: 6.5

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N

CWE: CWE-79

CVE-2019-11358

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-1321

CVE-2020-11023

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

sonatype-2020-0187

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSS Score: 6.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CWE: CWE-79

CVE-2021-23413

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g proto, toString, etc) results in a returned object with a modified prototype instance.

CVSS Score: 5.3

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CWE: CWE-1321

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

fix javadoc errors and unit test failures

…ult values for cloud bucketing. simplify DVC API Client to support both Cloud and Local bucketing requests

… polling interval. add Etag checking to config requests. update DVCClient (local) to not initialize unused DVC API Client

…aults to 10s timeout per request

…ment Manager to handle a 304 - Not Modified response from project config cdn.

Introduce Environment Config Manager

sonatype-lift · 2022-09-06T16:08:51Z

+	// Run `./gradlew build` in the root directory (`cd .. && ./gradlew build`) to build the local version of the SDK
+	implementation project(':java-server-sdk')

 	testImplementation 'org.springframework.boot:spring-boot-starter-test'


Critical Vulnerability:

pkg:maven/org.springframework.boot/spring-boot-starter@2.7.0

1 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components

pkg:maven/org.yaml/snakeyaml@1.30

CRITICAL Vulnerabilities (1)

Uncontrolled Resource Consumption

The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections.

CVSS Score: 7.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-400

SEVERE Vulnerabilities (1)

Stack-based Buffer Overflow

Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.

CVSS Score: 6.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-121

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Add LocalBucketing with DVCLocalClient.variable function working

Add allFeatures and allVariables methods to local client

Store config in local bucketing from config manager

…mmon interface (currently empty)

…rfaces for DVCOptions and DVCApi

…cloud split DVCOptions into Cloud and Bucketing Options that implement a common interface

Dvc 4209 event queue local bucketing methods

Dvc 4209 on payload failure

DVC-4412: implement EventQueueManager and track

DVC-4450: add event queue options and pass to initEventQueue

DVC-4466 Add Error Handling to Java Local Bucketing SDK

DVC-4350 add local track to example app

jonathannorris · 2022-09-19T19:11:41Z

+    DVCCloudClient dvcCloud;
+    DVCLocalClient dvcLocal;


should we have separate example apps for Local / Cloud?

We think the example app is simple enough that it can be kept together! I did add a custom track event button though

jonathannorris · 2022-09-19T19:29:42Z

+      userString = OBJECT_MAPPER.writeValueAsString(user);
+
+      bucketedUserConfig = localBucketing.generateBucketedConfig(serverKey, userString);


if this is a common action, might make sense to move this logic to the generateBucketedConfig method.

jonathannorris · 2022-09-19T19:30:04Z

+   */
+  public <T> Variable<T> variable(User user, String key, T defaultValue) {
+    validateUser(user);
+    localBucketing.setPlatformData(user.getPlatformData().toString());


again this should be done in a constructor somewhere.

…onstructor, parse user logic moved to generateBucketedConfig, and cleanup example app

…ersion of DVC Bucketing WASM file before gradle assemble task is called

jonathannorris · 2022-09-21T17:40:44Z

-    }
+  @Builder.Default
+  @JsonProperty("sdkVersion")
+  private String sdkVersion = "1.1.0";


Anyway to pull this from the Gradle or something so we don't have to manually update this all the time?

Getting the sdkVersion from the build.gradle file now

looks like its still manually defined here? any way to have this populate the version during build time? or dynamically at run-time?

for example: https://stackoverflow.com/questions/33020069/how-to-get-version-attribute-from-a-gradle-build-to-be-included-in-runtime-swing

I've followed this: https://stackoverflow.com/questions/37642837/gradle-make-build-version-available-to-java
So we're getting the sdkVersion this way: User.class.getPackage().getImplementationVersion()

jonathannorris · 2022-09-21T17:48:26Z

+    private void publishEvents(String serverKey, FlushPayload flushPayload) throws InterruptedException {
+        Thread publishEventsThread = new Thread(new Runnable() {
+            @Override
+            public void run() {


Does this callback on a different thread? or the same as the calling thread? just worried about threading calling WASM.

Hm, not sure if I got what you're asking completely but I think when we do publishEventsThread.start() it creates a new thread which then does run() on that newly created thread
https://www.geeksforgeeks.org/difference-between-thread-start-and-thread-run-in-java/

@kaushalkapasi do we have any thread locking around the calls to WASM?

no, we currently don't... this is the only area where we are use threads to interact with WASM for the onPayloadSuccess / onPayloadFailure callbacks

Ok it should be ok... but this is potentially risky, we should probably only call WASM from the same thread.

Add wasm to build process

kaushalkapasi and others added 4 commits August 26, 2022 20:17

split current java sdk into common and cloud folders

38de9f5

Merge pull request #13 from DevCycleHQ/create-common-package

c9ed0f6

split current java sdk into common and cloud folders

add DVCClient to be used for local bucketing. this will be the defaul…

22bbdac

…t behaviour going forward

Merge pull request #14 from DevCycleHQ/create-local-package

2186b09

add DVCClient class to be used for local bucketing

sonatype-lift Bot reviewed Aug 29, 2022

View reviewed changes

kaushalkapasi and others added 10 commits August 30, 2022 15:01

fix javadoc errors and unit test failures

cfd565d

Merge pull request #16 from DevCycleHQ/create-local-package

b44b1fe

fix javadoc errors and unit test failures

create EnvironmentConfigManager class

05da1b2

add enableCloudBucketing and configCdnBaseUrl to DVCOptions. add defa…

0eb832e

…ult values for cloud bucketing. simplify DVC API Client to support both Cloud and Local bucketing requests

update return type and url for getConfig API call

5aaf118

implement config fetching using ScheduledExecutorService with default…

19290ac

… polling interval. add Etag checking to config requests. update DVCClient (local) to not initialize unused DVC API Client

add callTimeout when fetching Project Config for local bucketing, def…

dfa18a4

…aults to 10s timeout per request

adds project config cache checking heads when polling. update Environ…

fda7a47

…ment Manager to handle a 304 - Not Modified response from project config cdn.

update DVC Options enableCloudBucketing to default to false

aba6a28

Merge pull request #17 from DevCycleHQ/DVC-4205-config-polling

07d68bd

Introduce Environment Config Manager

sonatype-lift Bot reviewed Sep 6, 2022

View reviewed changes

emmawillis and others added 11 commits September 7, 2022 10:56

Add LocalBucketing with storeConfig function working

0844a1c

Return BucketedUserConfig type and use in variable function

aee5af6

Merge pull request #18 from DevCycleHQ/DVC-4203-add-wasm

018e326

Add LocalBucketing with DVCLocalClient.variable function working

Add allFeatures and allVariables methods to local client

1c7eeef

Merge pull request #20 from DevCycleHQ/DVC-4347-allFeatures

8119801

Add allFeatures and allVariables methods to local client

Store config in local bucketing from config manager

0271f68

Merge pull request #22 from DevCycleHQ/DVC-4206-config2

ca1b42c

Store config in local bucketing from config manager

split dvcOptions into Cloud and Bucketing Options that implement a co…

aa70410

…mmon interface (currently empty)

rename interfaces with I prefix to make it easier to identify as inte…

3114131

…rfaces for DVCOptions and DVCApi

reorganization of classes into better folder structure

17960f9

update example app to work with refactored classes

b473c10

kaushalkapasi and others added 17 commits September 8, 2022 12:28

update build.gradle and pom.xml to include dependency on wasmtime

76fb9e5

Merge pull request #19 from DevCycleHQ/split-dvcOptions-to-local-and-…

90bedd5

…cloud split DVCOptions into Cloud and Bucketing Options that implement a common interface

Add wrapper functions for all event queue functions in local bucketing

32cb328

Merge pull request #23 from DevCycleHQ/DVC-4209-event-queue

5ea9135

Dvc 4209 event queue local bucketing methods

Uncomment onPayloadFailure and add local bucketing tests

db9ba7a

Merge pull request #24 from DevCycleHQ/DVC-4209-on-paylod-failure

857e6e1

Dvc 4209 on payload failure

implement EventQueueManager and track

8ff4f58

remove test

3aabe9d

rename to serverKey and cleanup

173731d

Merge pull request #25 from DevCycleHQ/DVC-4412-event-queue-manager

8f11c84

DVC-4412: implement EventQueueManager and track

add event queue options and pass to initEventQueue

11af702

Merge pull request #26 from DevCycleHQ/DVC-4450-event-queue-options

c60dfbc

DVC-4450: add event queue options and pass to initEventQueue

log errors in DVCLocalClient instead of throwing exceptions

75e0f51

return empty map in catch

b068493

Merge pull request #27 from DevCycleHQ/DVC-4466-error-handling

b224473

DVC-4466 Add Error Handling to Java Local Bucketing SDK

add Local - Track to example app to test custom events

23231c3

Merge pull request #29 from DevCycleHQ/DVC-4350-add-track-example-app

bc0712f

DVC-4350 add local track to example app

jonathannorris requested changes Sep 19, 2022

View reviewed changes

jonathannorris reviewed Sep 19, 2022

View reviewed changes

Comment thread src/main/java/com/devcycle/sdk/server/local/model/DVCLocalOptions.java Outdated

validate options in DVCLocalOptions constructor, setPlatformData in c…

18adbdc

…onstructor, parse user logic moved to generateBucketedConfig, and cleanup example app

chantalchung requested a review from jonathannorris September 21, 2022 16:37

update build.gradle to use undercouch download to pull the specific v…

9a88b6e

…ersion of DVC Bucketing WASM file before gradle assemble task is called

jonathannorris requested changes Sep 21, 2022

View reviewed changes

kaushalkapasi and others added 2 commits September 21, 2022 14:03

Merge pull request #28 from DevCycleHQ/add-wasm-to-build

7ef22e1

Add wasm to build process

add hostname to PlatformData and get sdkVersion from gradle

46752cc

chantalchung requested a review from jonathannorris September 21, 2022 19:19

jonathannorris approved these changes Sep 22, 2022

View reviewed changes

chantalchung marked this pull request as ready for review September 22, 2022 17:54

chantalchung merged commit 2f87c56 into main Sep 22, 2022

jonathannorris mentioned this pull request Jul 22, 2026

chore: resolve open dependabot security alerts #194

Merged

		@@ -1 +1,3 @@
		rootProject.name = "java-server-sdk-example-app" No newline at end of file
		rootProject.name = "java-server-sdk-example-app"

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

		userString = OBJECT_MAPPER.writeValueAsString(user);

		bucketedUserConfig = localBucketing.generateBucketedConfig(serverKey, userString);

Uh oh!

Conversation

kaushalkapasi commented Aug 29, 2022

Uh oh!

sonatype-lift Bot Aug 29, 2022

Choose a reason for hiding this comment

pkg:maven/org.springframework.boot/spring-boot-starter-web@2.7.0

Deserialization of Untrusted Data

Uh oh!

sonatype-lift Bot Aug 29, 2022

Choose a reason for hiding this comment

pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.7.0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Uh oh!

sonatype-lift Bot Aug 29, 2022

Choose a reason for hiding this comment

pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.7.0

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Uh oh!

sonatype-lift Bot Aug 29, 2022

Choose a reason for hiding this comment

pkg:maven/org.springframework.boot/spring-boot-starter-thymeleaf@2.7.0

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Uh oh!

sonatype-lift Bot Sep 6, 2022

Choose a reason for hiding this comment

pkg:maven/org.springframework.boot/spring-boot-starter@2.7.0

Uncontrolled Resource Consumption

Stack-based Buffer Overflow

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees