refactor: update version references to 1.5.0-RC1 across multiple files and add XssValidationException#40
Merged
Merged
Conversation
…s and add XssValidationException
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CODE_OF_CONDUCT.md`:
- Line 49: Add a period to the end of the sentence "To report a possible
violation, please email **pasinduogdev@gmail.com**" in CODE_OF_CONDUCT.md so it
reads with proper punctuation; locate that exact line and append a period to the
end of the sentence.
In `@src/main/java/io/github/og4dev/config/ApiResponseAutoConfiguration.java`:
- Line 220: The throw of XssValidationException is currently not mapped so it
falls through to the catch-all `@ExceptionHandler`(Exception.class) and returns
500; fix by mapping this exception to 400: either add an entry to
ApiExceptionRegistry that maps XssValidationException to HttpStatus.BAD_REQUEST
(so the existing resolution logic handles it), or add an explicit handler method
in GlobalExceptionHandler annotated with
`@ExceptionHandler`(XssValidationException.class) that returns a ResponseEntity
with HttpStatus.BAD_REQUEST and the appropriate error body; locate references to
XssValidationException, ApiExceptionRegistry, and GlobalExceptionHandler to
implement the chosen change.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 69abd270-e396-434e-a713-14f52cc6101b
📒 Files selected for processing (26)
CODE_OF_CONDUCT.mdREADME.mdpom.xmlsrc/main/java/io/github/og4dev/advice/GlobalResponseWrapper.javasrc/main/java/io/github/og4dev/advice/package-info.javasrc/main/java/io/github/og4dev/annotation/AutoResponse.javasrc/main/java/io/github/og4dev/annotation/AutoTrim.javasrc/main/java/io/github/og4dev/annotation/XssCheck.javasrc/main/java/io/github/og4dev/annotation/package-info.javasrc/main/java/io/github/og4dev/config/ApiResponseAutoConfiguration.javasrc/main/java/io/github/og4dev/config/package-info.javasrc/main/java/io/github/og4dev/dto/ApiResponse.javasrc/main/java/io/github/og4dev/dto/package-info.javasrc/main/java/io/github/og4dev/exception/ApiException.javasrc/main/java/io/github/og4dev/exception/ApiExceptionRegistry.javasrc/main/java/io/github/og4dev/exception/GlobalExceptionHandler.javasrc/main/java/io/github/og4dev/exception/XssValidationException.javasrc/main/java/io/github/og4dev/exception/package-info.javasrc/main/java/io/github/og4dev/filter/TraceIdFilter.javasrc/main/java/io/github/og4dev/filter/package-info.javasrc/main/java/io/github/og4dev/package-info.javasrc/test/java/io/github/og4dev/advice/GlobalResponseWrapperTest.javasrc/test/java/io/github/og4dev/annotation/AutoResponseAnnotationTest.javasrc/test/java/io/github/og4dev/config/AdvancedStringDeserializerTest.javasrc/test/java/io/github/og4dev/exception/ApiExceptionRegistryTest.javasrc/test/java/io/github/og4dev/exception/GlobalExceptionHandlerTest.java
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java (1)
236-244:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAdd missing HttpMessageNotReadableException handler and fix mislabeled XSS handler
Malformed JSON requests will return HTTP 500 instead of 400 because
HttpMessageNotReadableExceptionis imported but has no dedicated handler, allowing them to fall through to the catch-allException.classat line 152. Additionally, the XSS handler at line 239 is mislabeled with "Handles malformed JSON request exceptions" in its JavaDoc and logs "Malformed JSON request" messages, but actually handles XSS validation failures (security payloads detected during deserialization).Suggested fix
/** - * Handles malformed JSON request exceptions. + * Handles XSS validation exceptions. * * `@param` ex the XSS validation exception * `@return` ProblemDetail response with 400 status */ `@ExceptionHandler`(XssValidationException.class) public ProblemDetail handleXssValidationException(XssValidationException ex) { String traceId = getOrGenerateTraceId(); - log.warn("[TraceID: {}] Malformed JSON request: {}", traceId, ex.getMessage()); - ProblemDetail problemDetail = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "Malformed JSON request. Please check your request body format."); + log.warn("[TraceID: {}] XSS validation failed: {}", traceId, ex.getMessage()); + ProblemDetail problemDetail = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "Potentially unsafe input detected in request payload."); problemDetail.setProperty("traceId", traceId); problemDetail.setProperty("timestamp", Instant.now()); return problemDetail; } + /** + * Handles malformed JSON request exceptions. + * + * `@param` ex the malformed JSON exception + * `@return` ProblemDetail response with 400 status + */ + `@ExceptionHandler`(HttpMessageNotReadableException.class) + public ProblemDetail handleHttpMessageNotReadableException(HttpMessageNotReadableException ex) { + String traceId = getOrGenerateTraceId(); + log.warn("[TraceID: {}] Malformed JSON request: {}", traceId, ex.getMessage()); + ProblemDetail problemDetail = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "Malformed JSON request. Please check your request body format."); + problemDetail.setProperty("traceId", traceId); + problemDetail.setProperty("timestamp", Instant.now()); + return problemDetail; + }🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java` around lines 236 - 244, The XSS handler in GlobalExceptionHandler (method handleXssValidationException) is mislabeled/logs as handling malformed JSON; update its JavaDoc and log message to correctly indicate it handles XSS validation failures and keep the existing 400 ProblemDetail/traceId behavior (use getOrGenerateTraceId and ProblemDetail as already used). Also add a new dedicated handler method for HttpMessageNotReadableException (e.g., handleHttpMessageNotReadable) that generates a 400 ProblemDetail for malformed JSON, logs a warning with the traceId and ex.getMessage(), and sets the same "traceId" property so malformed JSON errors no longer fall through to the global Exception handler.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Outside diff comments:
In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java`:
- Around line 236-244: The XSS handler in GlobalExceptionHandler (method
handleXssValidationException) is mislabeled/logs as handling malformed JSON;
update its JavaDoc and log message to correctly indicate it handles XSS
validation failures and keep the existing 400 ProblemDetail/traceId behavior
(use getOrGenerateTraceId and ProblemDetail as already used). Also add a new
dedicated handler method for HttpMessageNotReadableException (e.g.,
handleHttpMessageNotReadable) that generates a 400 ProblemDetail for malformed
JSON, logs a warning with the traceId and ex.getMessage(), and sets the same
"traceId" property so malformed JSON errors no longer fall through to the global
Exception handler.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: f788a403-7a45-4b9d-9c31-4d7c7c572490
📒 Files selected for processing (2)
CODE_OF_CONDUCT.mdsrc/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java
✅ Files skipped from review due to trivial changes (1)
- CODE_OF_CONDUCT.md
…or unreadable HTTP message exceptions
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java`:
- Around line 240-243: The current handler handleXssValidationException logs
attacker-controlled content by including ex.getMessage(); change the log call to
only include the traceId and a fixed message (e.g. log.warn("[TraceID: {}] XSS
validation failed", traceId)) and remove any reference to ex.getMessage() or the
exception object from logging or returned ProblemDetail so no raw payload is
persisted; keep ProblemDetail.forStatusAndDetail(...) as the visible response.
- Around line 239-247: The HttpMessageNotReadable handlers should detect wrapped
XssValidationException instances and return the same XSS-specific ProblemDetail
as the direct handler: in both handleHttpMessageNotReadable methods, inspect
ex.getMostSpecificCause() (and walk the cause chain if null) for instanceof
XssValidationException, and if found build and return a ProblemDetail with
status BAD_REQUEST, detail "XSS validation failed. Invalid content detected.",
setProperty("traceId", getOrGenerateTraceId()) and setProperty("timestamp",
Instant.now()), and log using the same traceId; otherwise preserve the existing
malformed-JSON behavior. Ensure you reference XssValidationException,
getMostSpecificCause(), handleHttpMessageNotReadable, ProblemDetail, and
getOrGenerateTraceId() so both occurrences are updated consistently.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 605b2f04-b5c5-4e4f-8cc3-90d3e13a37b8
📒 Files selected for processing (1)
src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java
…tion and XSS exceptions
There was a problem hiding this comment.
♻️ Duplicate comments (2)
src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java (2)
274-276:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAvoid logging raw XSS exception messages in wrapped cause handling.
Line 276 logs
currentCause.getMessage()which may contain attacker-controlled XSS payloads. Apply the same fix as the direct handler—use a fixed message with traceId only.🛡️ Proposed fix
if (currentCause instanceof XssValidationException) { - String message = currentCause.getMessage() != null ? currentCause.getMessage() : "No details provided"; - log.warn("[TraceID: {}] XSS validation failed: {}", traceId, message); + log.warn("[TraceID: {}] XSS validation failed", traceId); ProblemDetail problemDetail = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "XSS validation failed. Invalid content detected.");🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java` around lines 274 - 276, In GlobalExceptionHandler, avoid logging attacker-controlled XSS payloads by changing the wrapped-cause branch that checks "currentCause instanceof XssValidationException" so it does not include currentCause.getMessage() in the log; instead call log.warn with a fixed, non-user-controlled message that includes only the traceId (similar to the direct XSS handler). Update the log.warn invocation referencing currentCause, XssValidationException, log.warn, and traceId to exclude the raw exception message.
243-251:⚠️ Potential issue | 🟠 Major | ⚡ Quick winAvoid logging raw XSS exception messages.
Line 246 logs
ex.getMessage()which may contain attacker-controlled payload fragments. This persists potentially malicious content in logs. Use a fixed message with traceId only.🛡️ Proposed fix
`@ExceptionHandler`(XssValidationException.class) public ProblemDetail handleXssValidationException(XssValidationException ex) { String traceId = getOrGenerateTraceId(); - log.warn("[TraceID: {}] XSS validation failed: {}", traceId, ex.getMessage()); + log.warn("[TraceID: {}] XSS validation failed", traceId); ProblemDetail problemDetail = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "XSS validation failed. Invalid content detected.");🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java` around lines 243 - 251, The handler handleXssValidationException currently logs attacker-controlled content by including ex.getMessage(); change the logging to avoid logging raw exception messages — for example, call log.warn("[TraceID: {}] XSS validation failed", traceId) (or log the exception type only) and do not append ex.getMessage() or any payload fragments; keep the ProblemDetail creation (ProblemDetail.forStatusAndDetail and setProperty calls) as-is but ensure no sensitive/attacker-controlled data is added to the response or logs. Use getOrGenerateTraceId() to correlate events and, if deeper diagnostics are needed, log full exception details only to a secure debug/audit sink, not the standard warn log.
🧹 Nitpick comments (1)
src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java (1)
264-270: 💤 Low valueRemove unreachable null check.
Spring's
@ExceptionHandlerinfrastructure never passesnullto handler methods. This branch is dead code and adds unnecessary complexity.♻️ Proposed fix
`@ExceptionHandler`(HttpMessageNotReadableException.class) public ProblemDetail handleHttpMessageNotReadable(HttpMessageNotReadableException ex) { String traceId = getOrGenerateTraceId(); - if (ex == null) { - log.warn("[TraceID: {}] Malformed JSON request: Unknown error (exception is null)", traceId); - ProblemDetail problemDetail = ProblemDetail.forStatusAndDetail(HttpStatus.BAD_REQUEST, "Malformed JSON request. Please check your request body format."); - problemDetail.setProperty("traceId", traceId); - problemDetail.setProperty("timestamp", Instant.now()); - return problemDetail; - } - Throwable currentCause = ex;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java` around lines 264 - 270, Remove the unreachable null-check branch in GlobalExceptionHandler: delete the "if (ex == null) { ... }" block that logs and returns a ProblemDetail for a null exception; instead rely on the ExceptionHandler method's normal flow using the non-null "ex" parameter and create/return the ProblemDetail directly where appropriate (remove references to the null-case traceId logging and ProblemDetail creation inside that branch). Ensure the handler method (the one receiving "ex") still sets traceId and timestamp properties on the ProblemDetail for malformed JSON without the dead null-check.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java`:
- Around line 274-276: In GlobalExceptionHandler, avoid logging
attacker-controlled XSS payloads by changing the wrapped-cause branch that
checks "currentCause instanceof XssValidationException" so it does not include
currentCause.getMessage() in the log; instead call log.warn with a fixed,
non-user-controlled message that includes only the traceId (similar to the
direct XSS handler). Update the log.warn invocation referencing currentCause,
XssValidationException, log.warn, and traceId to exclude the raw exception
message.
- Around line 243-251: The handler handleXssValidationException currently logs
attacker-controlled content by including ex.getMessage(); change the logging to
avoid logging raw exception messages — for example, call log.warn("[TraceID: {}]
XSS validation failed", traceId) (or log the exception type only) and do not
append ex.getMessage() or any payload fragments; keep the ProblemDetail creation
(ProblemDetail.forStatusAndDetail and setProperty calls) as-is but ensure no
sensitive/attacker-controlled data is added to the response or logs. Use
getOrGenerateTraceId() to correlate events and, if deeper diagnostics are
needed, log full exception details only to a secure debug/audit sink, not the
standard warn log.
---
Nitpick comments:
In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java`:
- Around line 264-270: Remove the unreachable null-check branch in
GlobalExceptionHandler: delete the "if (ex == null) { ... }" block that logs and
returns a ProblemDetail for a null exception; instead rely on the
ExceptionHandler method's normal flow using the non-null "ex" parameter and
create/return the ProblemDetail directly where appropriate (remove references to
the null-case traceId logging and ProblemDetail creation inside that branch).
Ensure the handler method (the one receiving "ex") still sets traceId and
timestamp properties on the ProblemDetail for malformed JSON without the dead
null-check.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 05791b85-558d-49ee-8ce2-afb03cf22b74
📒 Files selected for processing (1)
src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java
…rove readability for malformed JSON requests
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java`:
- Around line 279-282: The handler in GlobalExceptionHandler is currently
logging raw parser text via ex.getMessage() (seen around variables traceId and
errorMessage), which can leak attacker-controlled or sensitive request content;
change the logging to avoid including ex.getMessage() — emit a generic warning
like "Malformed JSON request: no details provided" with traceId only, and if you
need details for debugging, log the full exception at DEBUG/TRACE level or
capture a sanitized parsing error (not the raw body) via a safe helper in the
same method that strips or masks field values before logging.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 46cae521-af99-4a02-ba86-23b03e79f0e7
📒 Files selected for processing (1)
src/main/java/io/github/og4dev/exception/GlobalExceptionHandler.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit
New Features
Bug Fixes
Chores