Description

Detects potential Reflected Cross-Site Scripting (XSS) vulnerabilities in Kotlin Spring Boot applications where user input is returned to the client without proper sanitization. This could allow attackers to inject malicious scripts that execute in users' browsers when the response is rendered.

Detection Strategy

• Check if the application uses Spring Boot by looking for Controller or RestController annotations

• Look for controller methods that have constructor invocations and contain execution blocks

• Identify response data flows where user input is returned without proper HTML escaping or sanitization

• Flag methods that directly return user-provided data through Spring MVC endpoints

Vulnerable code example

@RestController
class XssController {
    @GetMapping("/hello")
    fun vulnerable(@RequestParam("name") name: String): String {
        return "Hello, $name!" // Vulnerable: Direct injection of user input into response
    }
}

✅ Secure code example

import org.springframework.web.bind.annotation.RestController
import org.springframework.web.bind.annotation.GetMapping
import org.springframework.web.bind.annotation.RequestParam
import org.springframework.web.util.HtmlUtils

@RestController
class XssController {
    @GetMapping("/hello")...