switch (form.crudMode) {
        case CrudMode.CREATE:
            return OptionalEntity.of(new WebAuthentication()).map(entity -> {
                entity.setCreatedBy(username);
                entity.setCreatedTime(currentTime);
                return entity;
            });
        case CrudMode.EDIT:
            if (form instanceof EditForm) {

	sql = strings.ReplaceAll(sql, `'`, `"`)

	// convert dialect special quote into double quote
	switch DB.Dialector.Name() {
	case "postgres", "gaussdb":
		sql = strings.ReplaceAll(sql, `"`, `"`)
	case "mysql", "sqlite":
		sql = strings.ReplaceAll(sql, "`", `"`)
	case "sqlserver":
		sql = strings.ReplaceAll(sql, `'`, `"`)
	}

	return sql

		}
		for segmentEnd > segmentStart && unicode.IsSpace(rune(path[segmentEnd-1])) {
			segmentEnd--
		}

		// Check for ".." or "."
		switch {
		case segmentEnd-segmentStart == 2 && path[segmentStart] == '.' && path[segmentStart+1] == '.':
			return true
		case segmentEnd-segmentStart == 1 && path[segmentStart] == '.':
			return true
		}
		i++
	}
	return false
}

 * methods of the delegate. For example, overriding {@link #add} alone <b>will not</b> change the
 * behavior of {@link #offer} which can lead to unexpected behavior. In this case, you should
 * override {@code offer} as well, either providing your own implementation, or delegating to the
 * provided {@code standardOffer} method.
 *

Attackers could simply run a script to send requests to your API, no need for browser interaction, so you are probably already securing any privileged endpoints.

In that case **this attack / risk doesn't apply to you**.

This risk and attack is mainly relevant when the app runs on the **local network** and that is the **only assumed protection**.

# new generation
if [ "x$FESS_HEAP_NEWSIZE" != "x" ]; then
    FESS_JAVA_OPTS="$FESS_JAVA_OPTS -Xmn${FESS_HEAP_NEWSIZE}"
fi

# set to headless, just in case
FESS_JAVA_OPTS="$FESS_JAVA_OPTS -Djava.awt.headless=true"

# maximum # keep-alive connections to maintain at once
FESS_JAVA_OPTS="$FESS_JAVA_OPTS -Dhttp.maxConnections=20"

# Force the JVM to use IPv4 stack

 * the methods of the delegate. For example, overriding {@link #getValue} alone <i>will not</i>
 * change the behavior of {@link #equals}, which can lead to unexpected behavior. In this case, you
 * should override {@code equals} as well, either providing your own implementation, or delegating
 * to the provided {@code standardEquals} method.
 *

func (p *providerCfg) initializeProvider(cfgGet func(string) string, transport http.RoundTripper) error {
	vendor := cfgGet(Vendor)
	if vendor == "" {
		return nil
	}
	var err error
	switch vendor {
	case keyCloakVendor:
		adminURL := cfgGet(KeyCloakAdminURL)
		realm := cfgGet(KeyCloakRealm)
		p.provider, err = provider.KeyCloak(
			provider.WithAdminURL(adminURL),

        // Under some edge cases (such as the proxy of JDK types serialized and then deserialized)
        // the proxy type may not be the same.
        // We first check isProxyClass() so that the common case of comparing with non-proxy objects
        // is efficient.
        || (Proxy.isProxyClass(arg.getClass())
            && Arrays.equals(arg.getClass().getInterfaces(), proxyClass.getInterfaces()));
  }

    private static OptionalEntity<ProtwordsItem> getEntity(final CreateForm form) {
        switch (form.crudMode) {
        case CrudMode.CREATE:
            final ProtwordsItem entity = new ProtwordsItem(0, StringUtil.EMPTY);
            return OptionalEntity.of(entity);
        case CrudMode.EDIT:
            if (form instanceof EditForm) {