How to address hopgoblins exposed json and feed for query builder

Question

Greetings,Our client has asked us to use this tool https://github.com/assetnote/hopgoblin to find and correct possible security issues that are detected in the tools scanner, while i was able to fix some of them, but i have not been able to find a solution for these twoI have tried using the dispatcher filter, but it has not workedAnd i have not been able to find out much more about these flags or how to correct them, so any help would be appreciated.Best Regards and Thanks in advanceDaniel

DanielMa63 · Accepted Answer

After creating the servlet, locate the sections of your code where those API endpoints are used and replace the calls with the URL for your new servlet.

Hello @giuseppebaglio our code does not really call those endpoints, it seems to just be a check from hopgoblin

After creating the servlet the flag still persists, maybe i did it wrong

Any other idea? Sorry for the trouble

Best Regards

Daniel

manikandan90 · Answer

To effectively mitigate this alert, direct access to the endpoints /bin/querybuilder.json and /bin/querybuilder.feed should be disabled. Instead, implement a custom servlet that encapsulates query execution logic. This servlet must enforce strict input validation and explicitly define the permissible queries to ensure controlled and secure operations.

Sign up

Login with SSO

Login to the community

Login with SSO