From 037a7577e68e58eb1a5cbce14dfa306d966fa905 Mon Sep 17 00:00:00 2001
From: unknown <cuiyan@moresec.cn>
Date: Tue, 4 Apr 2023 15:03:48 +0800
Subject: [PATCH] Fix Stored XSS Vulnerability in the System Notification
 Feature

---
 .../system/service/impl/SysNoticeServiceImpl.java      | 10 +++++++++-
 pom.xml                                                |  8 ++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/pear-modules/pear-system/src/main/java/com/pearadmin/system/service/impl/SysNoticeServiceImpl.java b/pear-modules/pear-system/src/main/java/com/pearadmin/system/service/impl/SysNoticeServiceImpl.java
index c54496b3..95ee3e30 100644
--- a/pear-modules/pear-system/src/main/java/com/pearadmin/system/service/impl/SysNoticeServiceImpl.java
+++ b/pear-modules/pear-system/src/main/java/com/pearadmin/system/service/impl/SysNoticeServiceImpl.java
@@ -8,6 +8,7 @@ import com.pearadmin.system.mapper.SysNoticeMapper;
 import com.pearadmin.system.service.ISysNoticeService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
+import com.coverity.security.Escape;
 
 import java.time.LocalDateTime;
 import java.util.List;
@@ -42,7 +43,14 @@ public class SysNoticeServiceImpl implements ISysNoticeService {
      */
     @Override
     public List<SysNotice> selectSysNoticeList(SysNotice sysNotice) {
-        return sysNoticeMapper.selectSysNoticeList(sysNotice);
+        List<SysNotice> sysNoticeList = sysNoticeMapper.selectSysNoticeList(sysNotice);
+        for (SysNotice notice : sysNoticeList) {
+            String escapedTitle = Escape.html(notice.getTitle());
+            String escapedContent = Escape.html(notice.getContent());
+            notice.setTitle(escapedTitle);
+            notice.setContent(escapedContent);
+        }
+        return sysNoticeList;
     }
 
     /**
diff --git a/pom.xml b/pom.xml
index 93c277c6..f48d9321 100644
--- a/pom.xml
+++ b/pom.xml
@@ -73,6 +73,8 @@
         <oshi.version>5.7.0</oshi.version>
         <!-- 网 路 工 具 -->
         <commons.net.version>3.8.0</commons.net.version>
+		<!-- XSS安全过滤 -->
+        <coverity.security.version>1.1.1</coverity.security.version>
         <!-- Maven 配 置 编 译 JDK 版 本-->
         <maven.compiler.target>8</maven.compiler.target>
         <maven.compiler.source>8</maven.compiler.source>
@@ -271,6 +273,12 @@
                 <version>${commons.net.version}</version>
                 <scope>compile</scope>
             </dependency>
+			<!-- XSS安全过滤 -->
+			<dependency>
+				<groupId>com.coverity.security</groupId>
+				<artifactId>coverity-escapers</artifactId>
+				<version>${coverity.security.version}</version>
+			</dependency>
         </dependencies>
     </dependencyManagement>
 
-- 
Gitee