Skip to content

Conversation

cbellone
Copy link
Member

Bump Spring Boot version to 3.2 + fix compilation / configuration errors

@cbellone cbellone requested a review from syjer April 19, 2024 13:04
Comment on lines +104 to +106
return http.securityMatchers(matchers -> matchers.requestMatchers(RequestTypeMatchers::isTokenAuthentication))
.sessionManagement(management -> management.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.csrf(AbstractHttpConfigurer::disable)

Check failure

Code scanning / CodeQL

Disabled Spring CSRF protection

CSRF vulnerability due to protection being disabled.
@@ -42,8 +46,8 @@
}

public DownloadedFile downloadFile(String url) {
HttpRequest httpRequest = HttpRequest.newBuilder(URI.create(url)).GET().build();
HttpResponse<byte[]> response = null;
HttpRequest httpRequest = HttpRequest.newBuilder(URI.create(requireNonNull(StringUtils.trimToNull(url)))).GET().build();

Check failure

Code scanning / CodeQL

Server-side request forgery

Potential server-side request forgery due to a [user-provided value](1). Potential server-side request forgery due to a [user-provided value](2). Potential server-side request forgery due to a [user-provided value](3). Potential server-side request forgery due to a [user-provided value](4).
Copy link

@syjer syjer merged commit 79c73ab into main Apr 25, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants