MAT-6547 XSS fix

MeasureAuthoringTool · Feb 23, 2024 · 53d25a6 · 53d25a6
1 parent 7e399e7
commit 53d25a6
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 5 deletions.
diff --git a/src/main/java/gov/cms/madie/resources/PackageController.java b/src/main/java/gov/cms/madie/resources/PackageController.java
@@ -61,10 +61,8 @@ public String getMeasureSimpleXml(
 
   @PutMapping(
       value = "/hqmf",
-      produces = {
-        MediaType.APPLICATION_XML_VALUE,
-      },
-      consumes = {MediaType.APPLICATION_JSON_VALUE})
+      produces = MediaType.APPLICATION_XML_VALUE,
+      consumes = MediaType.APPLICATION_JSON_VALUE)
   public ResponseEntity<String> generateHqmf(
       @RequestBody @Validated(Measure.ValidationSequence.class) Measure measure) throws Exception {
     // generate HQMF if the model type is QDM

diff --git a/src/test/java/gov/cms/madie/resources/PackageControllerMvcTest.java b/src/test/java/gov/cms/madie/resources/PackageControllerMvcTest.java
@@ -130,7 +130,8 @@ void testGetMeasureHqmf() throws Exception {
                     .contentType(MediaType.APPLICATION_JSON_VALUE))
             .andExpect(status().isOk())
             .andReturn();
-    assertThat(mvcResult.getResponse().getContentType(), is(equalTo("application/xml")));
+    assertThat(
+        mvcResult.getResponse().getContentType(), is(equalTo("application/xml;charset=UTF-8")));
     verify(hqmfService, times(1)).generateHqmf(any(QdmMeasure.class));
   }