Repository navigation
Conversation
Guard Core (spring-boot-guard 1.2.0) adds per-client request budgets, attack screening with auto-ban, upload limits, access control on the state-changing endpoints and behavior rules. It is off unless guard.enabled=true: the auto-configuration is filtered out before it is imported, so nothing is registered and behavior is unchanged by default. The Kotlin and coroutines BOMs are imported before the Spring Boot BOM because Spring Boot 3.5 manages Kotlin 1.9 and coroutines 1.8, while the guard needs Kotlin 2 and coroutines 1.11.
Runs the real application with the guard off and on: no component registered and unchanged responses by default; budgets give 429; traversal, XSS and scanner probes are rejected and repeated probing is banned; upload content type and size; admin allowlist and key; intranet previews are not blocked; a spoofed X-Forwarded-For does not reset a budget; large downloads stream.
… property Bump spring-boot-guard to 1.3.0 and drop GuardAutoConfigurationGate and its spring.factories entry: the library now honors guard.enabled itself. Its default is true, so ServerMain repeats guard.enabled=false as the lowest-precedence default, which keeps the guard off for operators whose own application.properties copy predates it.
…ning spring-boot-guard 1.3.0 keeps the multipart parts, but it scans file part payloads along with form fields, and kkFileView stores and previews html, sql and shell sources. Keep scanBody=false on /fileUpload, say why, and test that an upload is stored intact and a script-bearing html file is not refused.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This adds optional application-layer protection with spring-boot-guard 1.3.0 (MIT). It is off by default: with
guard.enabledunset orfalse, no guard bean, filter or property binding exists and nothing changes.When enabled (
KK_GUARD_ENABLED=true) it adds:/onlinePreview,/getCorsFile,/addTaskand/fileUploadIt is a second layer on the routes from the recent advisories (GHSA-xmfr-w3f5-hmr2, GHSA-mw74-3vmw-q3hg, GHSA-p2q6-8h6g-r47q and others), not a replacement for the code fixes. Every setting and limit is documented in
SECURITY_CONFIG.md.Notes:
/fileUploadkeeps body scanning off, so the html, sql and shell files kkFileView previews are not refused.mvn -B -pl server testshows the same 2 failures as master on macOS arm64 (a missing test resource and the SevenZipJBinding native library).Disclosure: I maintain spring-boot-guard and guard-core.