Skip XSS check for freemarker built-in escaping expressions in 2.3.24 instrumentation#10865
Merged
gh-worker-dd-mergequeue-cf854d[bot] merged 4 commits intomasterfrom Mar 18, 2026
Conversation
…s in 2.3.24 instrumentation
jandro996
added
type: bug
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 92be78dcf4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
...ation/freemarker/freemarker-2.3.24/src/main/java/freemarker/core/DollarVariable24Helper.java
Outdated
Show resolved
Hide resolved
…caping, the abstract base class that covers exactly ?html, ?xml, and ?xhtml in freemarker 2.3.24. Non-escaping built-ins like ?upper_case and ?js_string extend different base classes and are unaffected. Added parameterized unit tests to cover all cases.
BenchmarksStartupParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 63 metrics, 8 unstable metrics. Startup time reports for petclinicgantt
title petclinic - global startup overhead: candidate=1.61.0-SNAPSHOT~59186bb482, baseline=1.61.0-SNAPSHOT~3275dcc717
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.059 s) : 0, 1059080
Total [baseline] (11.059 s) : 0, 11059183
Agent [candidate] (1.068 s) : 0, 1068307
Total [candidate] (11.032 s) : 0, 11031527
section appsec
Agent [baseline] (1.247 s) : 0, 1247382
Total [baseline] (11.185 s) : 0, 11185269
Agent [candidate] (1.245 s) : 0, 1245011
Total [candidate] (11.133 s) : 0, 11132740
section iast
Agent [baseline] (1.226 s) : 0, 1225683
Total [baseline] (11.211 s) : 0, 11210669
Agent [candidate] (1.227 s) : 0, 1227463
Total [candidate] (11.284 s) : 0, 11284310
section profiling
Agent [baseline] (1.196 s) : 0, 1195952
Total [baseline] (11.019 s) : 0, 11018602
Agent [candidate] (1.189 s) : 0, 1189276
Total [candidate] (11.06 s) : 0, 11060408
gantt
title petclinic - break down per module: candidate=1.61.0-SNAPSHOT~59186bb482, baseline=1.61.0-SNAPSHOT~3275dcc717
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.198 ms) : 0, 1198
crashtracking [candidate] (1.208 ms) : 0, 1208
BytebuddyAgent [baseline] (629.149 ms) : 0, 629149
BytebuddyAgent [candidate] (632.507 ms) : 0, 632507
AgentMeter [baseline] (28.985 ms) : 0, 28985
AgentMeter [candidate] (29.299 ms) : 0, 29299
GlobalTracer [baseline] (256.402 ms) : 0, 256402
GlobalTracer [candidate] (258.586 ms) : 0, 258586
AppSec [baseline] (31.568 ms) : 0, 31568
AppSec [candidate] (31.927 ms) : 0, 31927
Debugger [baseline] (59.957 ms) : 0, 59957
Debugger [candidate] (60.506 ms) : 0, 60506
Remote Config [baseline] (579.677 µs) : 0, 580
Remote Config [candidate] (593.868 µs) : 0, 594
Telemetry [baseline] (8.024 ms) : 0, 8024
Telemetry [candidate] (8.09 ms) : 0, 8090
Flare Poller [baseline] (7.243 ms) : 0, 7243
Flare Poller [candidate] (9.502 ms) : 0, 9502
section appsec
crashtracking [baseline] (1.187 ms) : 0, 1187
crashtracking [candidate] (1.184 ms) : 0, 1184
BytebuddyAgent [baseline] (658.875 ms) : 0, 658875
BytebuddyAgent [candidate] (656.982 ms) : 0, 656982
AgentMeter [baseline] (12.019 ms) : 0, 12019
AgentMeter [candidate] (12.093 ms) : 0, 12093
GlobalTracer [baseline] (258.129 ms) : 0, 258129
GlobalTracer [candidate] (257.958 ms) : 0, 257958
IAST [baseline] (24.233 ms) : 0, 24233
IAST [candidate] (24.197 ms) : 0, 24197
AppSec [baseline] (177.884 ms) : 0, 177884
AppSec [candidate] (177.662 ms) : 0, 177662
Debugger [baseline] (66.175 ms) : 0, 66175
Debugger [candidate] (66.118 ms) : 0, 66118
Remote Config [baseline] (625.413 µs) : 0, 625
Remote Config [candidate] (611.214 µs) : 0, 611
Telemetry [baseline] (8.355 ms) : 0, 8355
Telemetry [candidate] (8.267 ms) : 0, 8267
Flare Poller [baseline] (3.581 ms) : 0, 3581
Flare Poller [candidate] (3.621 ms) : 0, 3621
section iast
crashtracking [baseline] (1.199 ms) : 0, 1199
crashtracking [candidate] (1.179 ms) : 0, 1179
BytebuddyAgent [baseline] (794.555 ms) : 0, 794555
BytebuddyAgent [candidate] (795.327 ms) : 0, 795327
AgentMeter [baseline] (11.324 ms) : 0, 11324
AgentMeter [candidate] (11.329 ms) : 0, 11329
GlobalTracer [baseline] (246.91 ms) : 0, 246910
GlobalTracer [candidate] (247.357 ms) : 0, 247357
IAST [baseline] (25.337 ms) : 0, 25337
IAST [candidate] (25.284 ms) : 0, 25284
AppSec [baseline] (26.57 ms) : 0, 26570
AppSec [candidate] (26.512 ms) : 0, 26512
Debugger [baseline] (70.708 ms) : 0, 70708
Debugger [candidate] (71.337 ms) : 0, 71337
Remote Config [baseline] (532.912 µs) : 0, 533
Remote Config [candidate] (543.283 µs) : 0, 543
Telemetry [baseline] (9.235 ms) : 0, 9235
Telemetry [candidate] (9.225 ms) : 0, 9225
Flare Poller [baseline] (3.329 ms) : 0, 3329
Flare Poller [candidate] (3.35 ms) : 0, 3350
section profiling
crashtracking [baseline] (1.188 ms) : 0, 1188
crashtracking [candidate] (1.182 ms) : 0, 1182
BytebuddyAgent [baseline] (691.597 ms) : 0, 691597
BytebuddyAgent [candidate] (687.02 ms) : 0, 687020
AgentMeter [baseline] (8.783 ms) : 0, 8783
AgentMeter [candidate] (8.701 ms) : 0, 8701
GlobalTracer [baseline] (217.75 ms) : 0, 217750
GlobalTracer [candidate] (216.74 ms) : 0, 216740
AppSec [baseline] (32.805 ms) : 0, 32805
AppSec [candidate] (32.653 ms) : 0, 32653
Debugger [baseline] (65.209 ms) : 0, 65209
Debugger [candidate] (65.471 ms) : 0, 65471
Remote Config [baseline] (579.31 µs) : 0, 579
Remote Config [candidate] (571.401 µs) : 0, 571
Telemetry [baseline] (9.329 ms) : 0, 9329
Telemetry [candidate] (8.438 ms) : 0, 8438
Flare Poller [baseline] (3.491 ms) : 0, 3491
Flare Poller [candidate] (3.458 ms) : 0, 3458
ProfilingAgent [baseline] (93.927 ms) : 0, 93927
ProfilingAgent [candidate] (93.929 ms) : 0, 93929
Profiling [baseline] (94.494 ms) : 0, 94494
Profiling [candidate] (94.493 ms) : 0, 94493
Startup time reports for insecure-bankgantt
title insecure-bank - global startup overhead: candidate=1.61.0-SNAPSHOT~59186bb482, baseline=1.61.0-SNAPSHOT~3275dcc717
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.061 s) : 0, 1060691
Total [baseline] (8.828 s) : 0, 8828319
Agent [candidate] (1.06 s) : 0, 1059696
Total [candidate] (8.825 s) : 0, 8824874
section iast
Agent [baseline] (1.226 s) : 0, 1226116
Total [baseline] (9.525 s) : 0, 9525489
Agent [candidate] (1.245 s) : 0, 1244669
Total [candidate] (9.581 s) : 0, 9581372
gantt
title insecure-bank - break down per module: candidate=1.61.0-SNAPSHOT~59186bb482, baseline=1.61.0-SNAPSHOT~3275dcc717
dateFormat X
axisFormat %s
section tracing
crashtracking [baseline] (1.191 ms) : 0, 1191
crashtracking [candidate] (1.199 ms) : 0, 1199
BytebuddyAgent [baseline] (628.837 ms) : 0, 628837
BytebuddyAgent [candidate] (628.67 ms) : 0, 628670
AgentMeter [baseline] (29.151 ms) : 0, 29151
AgentMeter [candidate] (29.054 ms) : 0, 29054
GlobalTracer [baseline] (256.874 ms) : 0, 256874
GlobalTracer [candidate] (257.221 ms) : 0, 257221
AppSec [baseline] (31.707 ms) : 0, 31707
AppSec [candidate] (31.646 ms) : 0, 31646
Debugger [baseline] (59.33 ms) : 0, 59330
Debugger [candidate] (59.386 ms) : 0, 59386
Remote Config [baseline] (601.536 µs) : 0, 602
Remote Config [candidate] (605.214 µs) : 0, 605
Telemetry [baseline] (8.154 ms) : 0, 8154
Telemetry [candidate] (8.064 ms) : 0, 8064
Flare Poller [baseline] (8.778 ms) : 0, 8778
Flare Poller [candidate] (7.863 ms) : 0, 7863
section iast
crashtracking [baseline] (1.195 ms) : 0, 1195
crashtracking [candidate] (1.214 ms) : 0, 1214
BytebuddyAgent [baseline] (793.942 ms) : 0, 793942
BytebuddyAgent [candidate] (809.015 ms) : 0, 809015
AgentMeter [baseline] (11.396 ms) : 0, 11396
AgentMeter [candidate] (11.875 ms) : 0, 11875
GlobalTracer [baseline] (247.954 ms) : 0, 247954
GlobalTracer [candidate] (250.418 ms) : 0, 250418
IAST [baseline] (25.53 ms) : 0, 25530
IAST [candidate] (25.738 ms) : 0, 25738
AppSec [baseline] (26.714 ms) : 0, 26714
AppSec [candidate] (26.994 ms) : 0, 26994
Debugger [baseline] (69.631 ms) : 0, 69631
Debugger [candidate] (69.552 ms) : 0, 69552
Remote Config [baseline] (522.514 µs) : 0, 523
Remote Config [candidate] (522.397 µs) : 0, 522
Telemetry [baseline] (9.649 ms) : 0, 9649
Telemetry [candidate] (9.574 ms) : 0, 9574
Flare Poller [baseline] (3.474 ms) : 0, 3474
Flare Poller [candidate] (3.466 ms) : 0, 3466
LoadParameters
See matching parameters
SummaryFound 3 performance improvements and 2 performance regressions! Performance is the same for 14 metrics, 17 unstable metrics.
Request duration reports for petclinicgantt
title petclinic - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~59186bb482, baseline=1.61.0-SNAPSHOT~3275dcc717
dateFormat X
axisFormat %s
section baseline
no_agent (19.209 ms) : 19012, 19406
. : milestone, 19209,
appsec (19.29 ms) : 19094, 19487
. : milestone, 19290,
code_origins (17.672 ms) : 17497, 17846
. : milestone, 17672,
iast (18.106 ms) : 17926, 18285
. : milestone, 18106,
profiling (18.776 ms) : 18586, 18966
. : milestone, 18776,
tracing (17.749 ms) : 17574, 17925
. : milestone, 17749,
section candidate
no_agent (18.102 ms) : 17920, 18283
. : milestone, 18102,
appsec (18.79 ms) : 18601, 18979
. : milestone, 18790,
code_origins (17.745 ms) : 17564, 17925
. : milestone, 17745,
iast (18.874 ms) : 18678, 19069
. : milestone, 18874,
profiling (18.809 ms) : 18624, 18995
. : milestone, 18809,
tracing (17.658 ms) : 17484, 17833
. : milestone, 17658,
Request duration reports for insecure-bankgantt
title insecure-bank - request duration [CI 0.99] : candidate=1.61.0-SNAPSHOT~59186bb482, baseline=1.61.0-SNAPSHOT~3275dcc717
dateFormat X
axisFormat %s
section baseline
no_agent (1.211 ms) : 1199, 1222
. : milestone, 1211,
iast (3.255 ms) : 3210, 3301
. : milestone, 3255,
iast_FULL (6.234 ms) : 6169, 6299
. : milestone, 6234,
iast_GLOBAL (3.409 ms) : 3357, 3462
. : milestone, 3409,
profiling (2.212 ms) : 2192, 2232
. : milestone, 2212,
tracing (1.822 ms) : 1806, 1838
. : milestone, 1822,
section candidate
no_agent (1.161 ms) : 1149, 1172
. : milestone, 1161,
iast (3.253 ms) : 3206, 3300
. : milestone, 3253,
iast_FULL (5.798 ms) : 5740, 5856
. : milestone, 5798,
iast_GLOBAL (3.568 ms) : 3509, 3628
. : milestone, 3568,
profiling (2.026 ms) : 2008, 2043
. : milestone, 2026,
tracing (1.82 ms) : 1804, 1836
. : milestone, 1820,
DacapoParameters
See matching parameters
SummaryFound 0 performance improvements and 0 performance regressions! Performance is the same for 11 metrics, 1 unstable metrics. Execution time for biojavagantt
title biojava - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~59186bb482, baseline=1.61.0-SNAPSHOT~3275dcc717
dateFormat X
axisFormat %s
section baseline
no_agent (14.942 s) : 14942000, 14942000
. : milestone, 14942000,
appsec (14.99 s) : 14990000, 14990000
. : milestone, 14990000,
iast (18.321 s) : 18321000, 18321000
. : milestone, 18321000,
iast_GLOBAL (17.68 s) : 17680000, 17680000
. : milestone, 17680000,
profiling (14.917 s) : 14917000, 14917000
. : milestone, 14917000,
tracing (15.014 s) : 15014000, 15014000
. : milestone, 15014000,
section candidate
no_agent (15.525 s) : 15525000, 15525000
. : milestone, 15525000,
appsec (14.758 s) : 14758000, 14758000
. : milestone, 14758000,
iast (18.381 s) : 18381000, 18381000
. : milestone, 18381000,
iast_GLOBAL (17.971 s) : 17971000, 17971000
. : milestone, 17971000,
profiling (15.119 s) : 15119000, 15119000
. : milestone, 15119000,
tracing (14.69 s) : 14690000, 14690000
. : milestone, 14690000,
Execution time for tomcatgantt
title tomcat - execution time [CI 0.99] : candidate=1.61.0-SNAPSHOT~59186bb482, baseline=1.61.0-SNAPSHOT~3275dcc717
dateFormat X
axisFormat %s
section baseline
no_agent (1.48 ms) : 1468, 1491
. : milestone, 1480,
appsec (3.822 ms) : 3600, 4043
. : milestone, 3822,
iast (2.252 ms) : 2183, 2321
. : milestone, 2252,
iast_GLOBAL (2.289 ms) : 2220, 2359
. : milestone, 2289,
profiling (2.112 ms) : 2056, 2169
. : milestone, 2112,
tracing (2.06 ms) : 2006, 2113
. : milestone, 2060,
section candidate
no_agent (1.477 ms) : 1465, 1489
. : milestone, 1477,
appsec (3.779 ms) : 3559, 3999
. : milestone, 3779,
iast (2.26 ms) : 2191, 2328
. : milestone, 2260,
iast_GLOBAL (2.307 ms) : 2238, 2377
. : milestone, 2307,
profiling (2.124 ms) : 2067, 2182
. : milestone, 2124,
tracing (2.078 ms) : 2024, 2132
. : milestone, 2078,
|
Contributor
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
gh-worker-dd-mergequeue-cf854d
bot
deleted the
alejandro.gonzalez/fix-iast-freemarker
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What Does This Do
escapedExpressionfield check inDollarVariable24Helper:BuiltIn, returnnulland skip the XSS sinkfreemarker-2.3.9instrumentationonXssis never called with anullvalueMotivation
The
DollarVariable24advice only checked theautoEscapeflag (set by<#ftl output_format="HTML" auto_esc=true>), but did not account for explicit built-in escaping like${name?html}. This caused a false positive XSS vulnerability report for templates using?html,?xml, etc.Additional Notes
Contributor Checklist
type:and (comp:orinst:) labels in addition to any other useful labelsclose,fix, or any linking keywords when referencing an issueUse
solvesinstead, and assign the PR milestone to the issueJira ticket: [PROJ-IDENT]
Note: Once your PR is ready to merge, add it to the merge queue by commenting
/merge./merge -ccancels the queue request./merge -f --reason "reason"skips all merge queue checks; please use this judiciously, as some checks do not run at the PR-level. For more information, see this doc.