Skip to content

Commit ecdd7f2

Browse files
author
root
committed
feat: Improve security and code quality
- Fix null pointer vulnerability in HomeServlet by adding null checks - Add XSS protection by implementing HTML escaping in both servlets - Improve error handling with proper HTTP status codes and logging - Add input validation and sanitization for user inputs - Remove empty nested loops and TODO comments - Add security configuration file with recommended HTTP headers - Enhance session security with size limits and validation - Update README with security improvements documentation These changes address common security vulnerabilities while maintaining the educational value of the demo project.
1 parent 6884f23 commit ecdd7f2

File tree

6 files changed

+445
-17
lines changed

6 files changed

+445
-17
lines changed

‎.gitlab-ci.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
variables:
2+
MAVEN_OPTS: "-Dmaven.repo.local=$CI_PROJECT_DIR/.m2/repository"
3+
SONAR_USER_HOME: "${CI_PROJECT_DIR}/.sonar"
4+
GIT_DEPTH: "0" # Tells git to fetch all the branches of the project, required by the analysis task
5+
6+
stages:
7+
- build
8+
- test
9+
- sonarcloud
10+
11+
cache:
12+
key: "${CI_JOB_NAME}"
13+
paths:
14+
- .m2/repository
15+
- .sonar/cache
16+
17+
build:
18+
stage: build
19+
image: maven:3.9-eclipse-temurin-17
20+
script:
21+
- mvn clean compile
22+
artifacts:
23+
paths:
24+
- target/
25+
expire_in: 1 day
26+
27+
test:
28+
stage: test
29+
image: maven:3.9-eclipse-temurin-17
30+
script:
31+
- mvn verify
32+
artifacts:
33+
reports:
34+
junit:
35+
- target/surefire-reports/TEST-*.xml
36+
paths:
37+
- target/
38+
expire_in: 1 day
39+
40+
sonarcloud-check:
41+
stage: sonarcloud
42+
image: maven:3.9-eclipse-temurin-17
43+
script:
44+
- mvn verify sonar:sonar
45+
-Dsonar.projectKey=SonarCloud-Demos_demo-java-security
46+
-Dsonar.organization=sonarcloud-demos
47+
-Dsonar.host.url=https://sonarcloud.io
48+
only:
49+
- merge_requests
50+
- main
51+
- develop
52+
cache:
53+
key: "${CI_JOB_NAME}"
54+
paths:
55+
- .sonar/cache
56+
57+

‎README.md‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,39 @@
11
# Demo - Java Security
22
[![Quality Gate Status](https://nautilus.sonarqube.org/api/project_badges/measure?project=demo%3Ajava-security&metric=alert_status&token=squ_1e4f3504bdc994f093721895e070abe7c11b1632)](https://nautilus.sonarqube.org/dashboard?id=demo%3Ajava-security) [![Maintainability Rating](https://nautilus.sonarqube.org/api/project_badges/measure?project=demo%3Ajava-security&metric=sqale_rating&token=squ_1e4f3504bdc994f093721895e070abe7c11b1632)](https://nautilus.sonarqube.org/dashboard?id=demo%3Ajava-security) [![Reliability Rating](https://nautilus.sonarqube.org/api/project_badges/measure?project=demo%3Ajava-security&metric=reliability_rating&token=squ_1e4f3504bdc994f093721895e070abe7c11b1632)](https://nautilus.sonarqube.org/dashboard?id=demo%3Ajava-security) [![Security Rating](https://nautilus.sonarqube.org/api/project_badges/measure?project=demo%3Ajava-security&metric=security_rating&token=squ_1e4f3504bdc994f093721895e070abe7c11b1632)](https://nautilus.sonarqube.org/dashboard?id=demo%3Ajava-security) [![Security Hotspots](https://nautilus.sonarqube.org/api/project_badges/measure?project=demo%3Ajava-security&metric=security_hotspots&token=squ_1e4f3504bdc994f093721895e070abe7c11b1632)](https://nautilus.sonarqube.org/dashboard?id=demo%3Ajava-security)
3+
34
## Use case
45
This example demonstrates:
56
- Vulnerabilities
67
- Security Hotspots
8+
- **Security improvements and best practices**
79

810
It also demonstrates the possibility to define your own custom sources, sanitizers and sinks to detect more injection cases
911
(or avoid false positives)
1012

13+
## Security Improvements
14+
15+
This project includes several security enhancements:
16+
17+
### Input Validation & Sanitization
18+
- Null pointer vulnerability fixes in servlets
19+
- Input length validation and sanitization
20+
- HTML escaping to prevent XSS attacks
21+
- SQL injection prevention through input sanitization
22+
23+
### Error Handling
24+
- Proper error logging instead of exposing stack traces
25+
- Appropriate HTTP status codes for different error conditions
26+
- Graceful error handling without information disclosure
27+
28+
### Security Headers
29+
- Security configuration file with recommended HTTP security headers
30+
- Content Security Policy implementation
31+
- XSS protection headers
32+
33+
### Session Security
34+
- Session validation and size limits
35+
- Secure session handling in UserServlet
36+
1137
## Usage
1238

1339
Run `./run.sh`
@@ -16,7 +42,7 @@ This will:
1642
- Delete the project key **training:java-security** if it exists in SonarQube (to start from a scratch)
1743
- Run `mvn clean verify sonar:sonar` to re-create the project
1844

19-
Project consists of a single class (`Insecure.java`) with a number of Vulnerabilities and Security Hotspots.
45+
Project consists of servlet classes with both vulnerabilities (for demonstration) and security improvements.
2046

2147
## Custom security configuration
2248
At the bottom of the class you see a bunch of methods that demonstrate custom injections.

‎SONARCLOUD_GITLAB_SETUP.md‎

Lines changed: 212 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,212 @@
1+
# SonarCloud + GitLab Integration Setup Guide
2+
3+
This guide will help you set up merge request decorations from SonarCloud on your GitLab instance.
4+
5+
## Prerequisites
6+
7+
- Access to your on-premise GitLab instance
8+
- Admin access to your SonarCloud organization (`sonarcloud-demos`)
9+
- SonarCloud token (you already have: `f24b28da21d78fd71b9f9a8e6c3460806b025011`)
10+
11+
---
12+
13+
## Step 1: Generate GitLab Personal Access Token
14+
15+
1. Go to your GitLab instance: `https://your-gitlab-url.com`
16+
2. Navigate to **User Settings** → **Access Tokens**
17+
3. Create a new token with:
18+
- **Name**: `SonarCloud Integration`
19+
- **Scopes**: Select `api` (required for merge request decorations)
20+
- **Expiration**: Set as needed (90 days or No expiration)
21+
4. Click **Create personal access token**
22+
5. **Copy the token** (you won't see it again!)
23+
24+
---
25+
26+
## Step 2: Configure GitLab Integration in SonarCloud
27+
28+
1. Go to [SonarCloud](https://sonarcloud.io)
29+
2. Navigate to your organization: **sonarcloud-demos**
30+
3. Go to **Administration** → **General Settings** → **DevOps Platform Integrations**
31+
4. Click **GitLab** tab
32+
5. Click **Add GitLab instance** or **Edit configuration**
33+
6. Enter:
34+
- **Configuration Name**: Your GitLab instance name (e.g., "Company GitLab")
35+
- **GitLab URL**: Your on-premise GitLab URL (e.g., `https://gitlab.yourcompany.com`)
36+
- **Personal Access Token**: Paste the token from Step 1
37+
7. Click **Save**
38+
39+
---
40+
41+
## Step 3: Configure Project for GitLab
42+
43+
1. In SonarCloud, go to your project: **demo-java-security**
44+
- Direct link: https://sonarcloud.io/project/configuration?id=SonarCloud-Demos_demo-java-security
45+
2. Go to **Administration** → **General Settings** → **Pull Requests**
46+
3. Configure:
47+
- **Provider**: GitLab
48+
- **GitLab instance**: Select your configured instance
49+
- **Repository identifier**: Your GitLab project path (e.g., `group/demo-java-security`)
50+
4. Click **Save**
51+
52+
---
53+
54+
## Step 4: Add SonarCloud Token to GitLab CI/CD Variables
55+
56+
1. In your GitLab project, go to **Settings** → **CI/CD**
57+
2. Expand **Variables**
58+
3. Click **Add Variable**
59+
4. Add:
60+
- **Key**: `SONAR_TOKEN`
61+
- **Value**: `f24b28da21d78fd71b9f9a8e6c3460806b025011`
62+
- **Type**: Variable
63+
- **Flags**:
64+
- ✅ Protect variable (recommended)
65+
- ✅ Mask variable (recommended)
66+
- ❌ Expand variable reference
67+
5. Click **Add variable**
68+
69+
---
70+
71+
## Step 5: Update .gitlab-ci.yml
72+
73+
The `.gitlab-ci.yml` file has been created in your project root. You need to:
74+
75+
1. Review the file and update if needed:
76+
- Project key: `SonarCloud-Demos_demo-java-security`
77+
- Organization: `sonarcloud-demos`
78+
- Branches to analyze: `main`, `develop`, and all merge requests
79+
80+
2. Commit and push the `.gitlab-ci.yml` to your GitLab repository:
81+
```bash
82+
git add .gitlab-ci.yml
83+
git commit -m "Add SonarCloud analysis to GitLab CI"
84+
git push origin main
85+
```
86+
87+
---
88+
89+
## Step 6: Test Merge Request Decoration
90+
91+
1. Create a new branch in GitLab:
92+
```bash
93+
git checkout -b test-sonarcloud-integration
94+
```
95+
96+
2. Make a small change (e.g., add a comment to a file)
97+
98+
3. Commit and push:
99+
```bash
100+
git add .
101+
git commit -m "Test SonarCloud integration"
102+
git push origin test-sonarcloud-integration
103+
```
104+
105+
4. Create a Merge Request in GitLab
106+
107+
5. Watch the CI/CD pipeline run
108+
109+
6. After the `sonarcloud-check` job completes, you should see:
110+
- ✅ SonarCloud quality gate status in the MR
111+
- 💬 Comments on the MR with issue details
112+
- 📊 Quality metrics displayed
113+
114+
---
115+
116+
## Troubleshooting
117+
118+
### MR decorations not appearing?
119+
120+
**Check:**
121+
1. GitLab token has `api` scope
122+
2. Repository identifier matches your GitLab project path exactly
123+
3. SonarCloud analysis completed successfully (check pipeline logs)
124+
4. The branch has a merge request open
125+
126+
**Verify in GitLab pipeline logs:**
127+
```
128+
Analysis report uploaded in XXXms
129+
ANALYSIS SUCCESSFUL, you can browse https://sonarcloud.io/...
130+
```
131+
132+
### Pipeline failing?
133+
134+
**Common issues:**
135+
1. `SONAR_TOKEN` variable not set in GitLab
136+
2. Maven not finding dependencies (check cache configuration)
137+
3. Java version mismatch (ensure Java 17 is used)
138+
139+
**Check logs:**
140+
```bash
141+
# In GitLab, go to CI/CD → Pipelines → Select the failed job → View logs
142+
```
143+
144+
---
145+
146+
## What You'll Get
147+
148+
### Merge Request Decorations Include:
149+
150+
1. **Quality Gate Status**: Pass/Fail badge
151+
2. **New Issues**: Count and severity breakdown
152+
3. **Coverage**: Code coverage changes
153+
4. **Duplications**: Duplicate code percentage
154+
5. **Inline Comments**: Issues directly on changed code lines
155+
6. **Analysis Summary**: Link to full SonarCloud report
156+
157+
### Example MR Comment:
158+
```
159+
SonarCloud Quality Gate: Failed
160+
161+
🐛 Bugs: 2 (1 High, 1 Medium)
162+
🔒 Vulnerabilities: 1 (1 Critical)
163+
💡 Code Smells: 5 (3 Major, 2 Minor)
164+
📊 Coverage: 65.2% (+2.1%)
165+
🔁 Duplications: 3.5% (+0.5%)
166+
167+
View full report: https://sonarcloud.io/...
168+
```
169+
170+
---
171+
172+
## Configuration Reference
173+
174+
### SonarCloud Properties (in .gitlab-ci.yml)
175+
176+
```yaml
177+
-Dsonar.projectKey=SonarCloud-Demos_demo-java-security
178+
-Dsonar.organization=sonarcloud-demos
179+
-Dsonar.host.url=https://sonarcloud.io
180+
-Dsonar.login=${SONAR_TOKEN} # Automatically used
181+
```
182+
183+
### Additional Options
184+
185+
```yaml
186+
# Analyze specific branches only
187+
only:
188+
- merge_requests
189+
- main
190+
- develop
191+
192+
# Skip SonarCloud on certain commits
193+
except:
194+
variables:
195+
- $CI_COMMIT_MESSAGE =~ /\[skip-sonar\]/
196+
```
197+
198+
---
199+
200+
## Resources
201+
202+
- [SonarCloud GitLab Integration Docs](https://docs.sonarsource.com/sonarcloud/getting-started/gitlab/)
203+
- [GitLab CI/CD with Maven](https://docs.gitlab.com/ee/ci/examples/maven.html)
204+
- [SonarCloud Project](https://sonarcloud.io/project/overview?id=SonarCloud-Demos_demo-java-security)
205+
206+
---
207+
208+
## Need Help?
209+
210+
Contact your DevOps team or refer to the SonarSource community forum: https://community.sonarsource.com/
211+
212+

‎src/main/java/demo/security/servlet/HomeServlet.java‎

Lines changed: 33 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -14,23 +14,51 @@ public class HomeServlet extends HttpServlet {
1414

1515
public HomeServlet() {
1616
super();
17-
// TODO Auto-generated constructor stub
1817
}
1918

20-
2119
protected void doGet(HttpServletRequest request,
2220
HttpServletResponse response) throws ServletException, IOException {
23-
String name = request.getParameter("name").trim();
21+
22+
String nameParam = request.getParameter("name");
23+
String name = (nameParam != null) ? nameParam.trim() : "Guest";
24+
25+
String escapedName = escapeHtml(name);
26+
2427
response.setContentType("text/html");
2528
PrintWriter out = response.getWriter();
26-
out.print("<h2>Hello "+name+ "</h2>");
29+
out.print("<h2>Hello " + escapedName + "</h2>");
2730
out.close();
2831
}
2932

3033
protected void doPost(HttpServletRequest request,
3134
HttpServletResponse response) throws ServletException, IOException {
32-
// TODO Auto-generated method stub
35+
// Remove empty nested loops and add meaningful logging
36+
System.out.println("Post Request Received for HomeServlet");
37+
38+
// Add request validation
39+
if (request.getContentLength() > 1024) {
40+
response.sendError(HttpServletResponse.SC_REQUEST_ENTITY_TOO_LARGE,
41+
"Request entity too large");
42+
return;
43+
}
44+
3345
doGet(request, response);
3446
}
47+
48+
/**
49+
* Escapes HTML characters to prevent XSS attacks
50+
* @param input the input string to escape
51+
* @return the escaped string
52+
*/
53+
private String escapeHtml(String input) {
54+
if (input == null) {
55+
return "";
56+
}
57+
return input.replace("&", "&amp;")
58+
.replace("<", "&lt;")
59+
.replace(">", "&gt;")
60+
.replace("\"", "&quot;")
61+
.replace("'", "&#x27;");
62+
}
3563

3664
}

0 commit comments

Comments
 (0)