XSS Cross Site Scripting - on JSP input tag

Question

The following piece of code in my JSP caused a cross site scripting vulnerability on the input tag.

<td id="locale-block" align="left" style="visibility: hidden; height: 0;">
    <input type="text" id="locale" name="locale" text="eng" value = "eng">eng
</td>

During Penetration testing they were able to alert some random message to the user by injecting a alert script in the value attribute of the tag as follows

</script><script>alert(1);</script><script>

What should be done to avoid this? Is there any simple solution which does not involve paid 3rd party paid library?

Robin Jonsson · Accepted Answer · 2014-02-19 07:51:59Z

1

There's actually a good 3rd party lib that takes care of sanitation pretty easily, called OWASP.

I first heard about it at JFokus 2014, from WhiteHat Security Jim Manico, in his speech about JAVA Security.

Check it out: here

answered Feb 19, 2014 at 7:51

Robin Jonsson

2,8513 gold badges27 silver badges42 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Abhijith Nagaraja Over a year ago

Thanks for the answer. But I do not want a JAVA security framework for now. I want jsp xss validation/prevention framework

Collectives™ on Stack Overflow

XSS Cross Site Scripting - on JSP input tag

1 Answer 1

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Related