Update HelloController.java by layro01 · Pull Request #5 · layro01/java-api-goat

DryRun Security

⚠️ Potential Cross-Site Scripting src/main/java/com/veracode/iast/samples/apigoat/HelloController.java (click for details)

Type

Potential Cross-Site Scripting

Description

The controller reads an HTTP request parameter and returns it directly in the response body without any encoding or sanitization.

Filename

src/main/java/com/veracode/iast/samples/apigoat/HelloController.java

CodeLink

Lines 19 to 21 in 7adde5c

    
           		return String.format(template, param); 
        
           	} 
        
           }