java - Fix SERVLET_PARAMETER (Untrusted servlet parameter) spotbugs problem

Question

extractQueryParam extracts a specific query parameter from a request using getParameter(String paramName).

The query parameter will contain a Base64 encoded String.

private String extractQueryParam(HttpServletRequest request, String queryParamName) {
  return request.getParameter(queryParamName);
}

However request.getParameter(queryParamName) is throwing a SpotBugs problem:

Problem classification:
Security (Servlet Parameter)
SERVLET_PARAMETER (Untrusted servlet parameter)

The method getParameter returns a String value that is controlled by the client
Low Confidence Security

Untrusted servlet parameter
The Servlet can read GET and POST parameters from various methods. 
The value obtained should be considered unsafe. 
You may need to validate or sanitize those values before passing them to sensitive APIs such as:
- SQL query (May leads to SQL injection)
- File opening (May leads to path traversal)
- Command execution (Potential Command injection)
- HTML construction (Potential XSS)
- etc...
 
Reference CWE-20: Improper Input Validation

I've tried various validation (example next), but the problem continues to show.

What could I do to fix this SpotBugs problem?

private String extractQueryParam(HttpServletRequest request, String queryParamName) {
  String result = null;
  String parsedParam = request.getParameter(queryParamName);
  if (!parsedParam.isBlank() && !parsedParam.isEmpty()) {
    result = parsedParam;
  }
  return result;
}

Method that invokes extractQueryParam:

@Override
public void onAuthenticationFailure(
    HttpServletRequest request, HttpServletResponse response, AuthenticationException exception)
    throws IOException {

  if (exception instanceof OAuth2AuthenticationException) {

    String encodedState = extractQueryParam(request, "state");
    byte[] decodedState = Base64.getDecoder().decode(encodedState.getBytes(StandardCharsets.UTF_8));
    String destinationUrl = objectMapper.readTree(decodedState).get(DESTINATION_URL_KEY).asText();
    String url = RedirectUtils.getRelativeUriStringFromUrl(destinationUrl);
    RedirectUtils.safeRedirect(response, url);

  } else {
    throw exception;
  }
}

question from:https://stackoverflow.com/questions/65837880/fix-servlet-parameter-untrusted-servlet-parameter-spotbugs-problem

Answer 1

Waitting for answers