Restyle Eap7.4.x #20
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -49,12 +49,12 @@ public static WebArchive createTestArchive() { | |
| Asset webXml = new ByteArrayAsset( | ||
| extendDefaultWebXml( | ||
| listeners.toString() + | ||
| ("<servlet><servlet-name>Bat " | ||
| + "Servlet</servlet-name><servlet-class>") + | ||
| BatServlet.class.getName() + | ||
| ("</servlet-class></servlet> <servlet-mapping><servlet-name>Bat " | ||
| + "Servlet</servlet-name><url-pattern>/bat</url-pattern></" | ||
| + "servlet-mapping>")) | ||
|
Comment on lines
49
to
+57
There was a problem hiding this comment. The construction of XML content through string concatenation (lines 49-57) is prone to errors and difficult to maintain. This approach can lead to issues such as typos, mismatched tags, or improperly formatted XML, which are hard to detect until runtime. Recommendation: Consider using a more structured approach to generate XML, such as utilizing an XML library (e.g.,
Comment on lines
49
to
+57
There was a problem hiding this comment. The construction of XML content through string concatenation is error-prone and can lead to maintenance issues. It is recommended to use an XML builder or similar utility to construct XML documents. This approach enhances readability, reduces the risk of errors, and makes the code easier to maintain. Recommended Change: DocumentBuilderFactory dbFactory = DocumentBuilderFactory.newInstance();
DocumentBuilder dBuilder = dbFactory.newDocumentBuilder();
Document doc = dBuilder.newDocument();
// build XML document with doc.createElement, etc.This method ensures that the XML is well-formed and easier to modify or extend in the future.
Comment on lines
49
to
+57
There was a problem hiding this comment. Directly constructing XML from strings can expose the application to XML Injection, especially if any part of the XML structure is derived from untrusted sources. To mitigate this risk, ensure that any dynamic content is properly escaped or sanitized before inclusion in the XML structure. Recommended Change: There was a problem hiding this comment. Micro-Learning Topic: XML injection (Detected by phrase)Matched on "XML Injection"XML injection is a vulnerability affecting the handling of XML documents used by an application. If an application uses unsafe inputs as part of an XML document, it may result in corrupted XML that changes the behaviour of application components that use the modified document. Where XML documents are accepted by an application, it may allow information disclosure, denial of service or unauthorised file access if certain XML processing is permitted. Try a challenge in Secure Code WarriorHelpful references
|
||
| .getBytes()); | ||
| return baseDeployment(webXml).addClasses( | ||
| BatRequestListener.class, BatSessionListener.class, | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The method
unexpectedClassLoaderlogs a warning when an unexpected class loader is encountered, but it lacks parameters that could provide more context about the issue, such as the URL or specific class loader that was expected. This makes debugging more difficult.Recommendation:
Consider adding parameters to capture the URL and the expected class loader type. This would provide more actionable information in the log message, aiding in quicker resolution of issues.