CVE-2018-20594 (Java, published 2018-12-30T18:29Z)
Description: value: An issue was discovered in hsweb 3.0.4. It is a reflected XSS vulnerability due to the absence of type parameter checking in FlowableModelManagerController.java.
Severity: MEDIUM (CVSS v3 base score: 6.1)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/hs-web/hsweb-framework
Files changed:
hsweb-system/hsweb-system-workflow/hsweb-system-workflow-local/src/main/java/org/hswebframework/web/workflow/enums/ModelType.java
hsweb-system/hsweb-system-workflow/hsweb-system-workflow-local/src/main/java/org/hswebframework/web/workflow/web/FlowableModelManagerController.java
Commit message: fix #107  修复反射型xss


Vulnerable code:
                       @PathVariable("type") @ApiParam(value = "类型", allowableValues = "bpmn,json", example = "json") String type,
        try {
            Model modelData = repositoryService.getModel(modelId);
            BpmnJsonConverter jsonConverter = new BpmnJsonConverter();
            byte[] modelEditorSource = repositoryService.getModelEditorSource(modelData.getId());

            JsonNode editorNode = new ObjectMapper().readTree(modelEditorSource);
            BpmnModel bpmnModel = jsonConverter.convertToBpmnModel(editorNode);

            // 处理异常
            if (bpmnModel.getMainProcess() == null) {
                response.setStatus(HttpStatus.UNPROCESSABLE_ENTITY.value());
                response.getOutputStream().println("no main process, can't export for dimension: " + type);
                response.flushBuffer();
                return;
            }

            String filename = "";
            byte[] exportBytes = null;

            String mainProcessId = bpmnModel.getMainProcess().getId();
            if ("bpmn".equals(type)) {
                BpmnXMLConverter xmlConverter = new BpmnXMLConverter();
                exportBytes = xmlConverter.convertToXML(bpmnModel);
                filename = mainProcessId + ".bpmn20.xml";
            } else if ("json".equals(type)) {
                exportBytes = modelEditorSource;
                filename = mainProcessId + ".json";
            } else {
                throw new UnsupportedOperationException("不支持的格式:" + type);
            }
            response.setCharacterEncoding("UTF-8");
            response.setContentType("application/octet-stream");
            response.setHeader("Content-Disposition", "attachment; filename=" + URLEncoder.encode(filename, "UTF-8"));
            /*创建输入流*/
            try (ByteArrayInputStream in = new ByteArrayInputStream(exportBytes)) {
                IOUtils.copy(in, response.getOutputStream());
                response.flushBuffer();
                in.close();
            }
        } catch (Exception e) {
            log.error("导出model的xml文件失败：modelId={}, type={}", modelId, type, e);

Fixed code:
package org.hswebframework.web.workflow.enums;

/**
 * @author zhouhao
 * @since 3.0.5
 */
public enum ModelType {
    bpmn, json
}
import lombok.SneakyThrows;
import org.hswebframework.web.workflow.enums.ModelType;
    @SneakyThrows
                       @PathVariable("type") @ApiParam(value = "类型", allowableValues = "bpmn,json", example = "json")
                               ModelType type,
        Model modelData = repositoryService.getModel(modelId);
        if (modelData == null) {
            throw new NotFoundException("模型不存在");
        }
        BpmnJsonConverter jsonConverter = new BpmnJsonConverter();
        byte[] modelEditorSource = repositoryService.getModelEditorSource(modelData.getId());
        JsonNode editorNode = new ObjectMapper().readTree(modelEditorSource);
        BpmnModel bpmnModel = jsonConverter.convertToBpmnModel(editorNode);
        // 处理异常
        if (bpmnModel.getMainProcess() == null) {
            throw new UnsupportedOperationException("无法导出模型文件:" + type);
        }
        String filename = "";
        byte[] exportBytes = null;
        String mainProcessId = bpmnModel.getMainProcess().getId();
        if (type == ModelType.bpmn) {
            BpmnXMLConverter xmlConverter = new BpmnXMLConverter();
            exportBytes = xmlConverter.convertToXML(bpmnModel);
            filename = mainProcessId + ".bpmn20.xml";
        } else if (type == ModelType.json) {
            exportBytes = modelEditorSource;
            filename = mainProcessId + ".json";
        } else {
            throw new UnsupportedOperationException("不支持的格式:" + type);
        }
        response.setCharacterEncoding("UTF-8");
        response.setContentType("application/octet-stream");
        response.setHeader("Content-Disposition", "attachment; filename=" + URLEncoder.encode(filename, "UTF-8"));
        /*创建输入流*/
        try (ByteArrayInputStream in = new ByteArrayInputStream(exportBytes)) {
            IOUtils.copy(in, response.getOutputStream());
            response.flushBuffer();