Protection against Cross site scripting on specific JSP and Servlet code

Question

Here are the servelet cum JSP code, let me know how we could protect them from XSS?

Servlet Code:

String strRequestScrip = SecurityCheck.getStringParameter(request,PARAM_SCRIP_CODE);

 List arrScripLocator = MarketWatchUtils.getEqScripLocator(strRequestScrip, strExchangeCode, application);

 request.setAttribute("arrScripLocator", arrScripLocator);

 request.getRequestDispatcher("/ajax/ajaxScripLocator.jsp").forward(request, response);

Jsp Code:

final List arrScripLocator = (List) request.getAttribute("arrScripLocator");

int intScripLocatorSize = arrScripLocator != null ? arrScripLocator.size() : 0;

intScripLocatorSize = intScripLocatorSize <= 20 ? intScripLocatorSize : 20;

out.print(intScripLocatorSize);

fgpr0x · Accepted Answer · 2015-04-11 17:31:09Z

1

You should use Jsoup to sanitize the request. The code will look like this:

String unsafe ="<p><a href='http://example.com/' onclick='stealCookies()'>Link</a></p>";
String safe = Jsoup.clean(unsafe, Whitelist.basic());
// now: <p><a href="http://example.com/" rel="nofollow">Link</a></p>

I recommend you also read the OWASP XSS Filter Evasion Sheet.

answered Apr 11, 2015 at 17:31

fgpr0x

1114 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Shritam Bhowmick Over a year ago

Thank you for the answer. This would be great if I am able to help the IT admin.

Collectives™ on Stack Overflow

Protection against Cross site scripting on specific JSP and Servlet code

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related