How to detect XSS in Java using OWASP

Question

I have this thing which I'm dealing with right now, XSS.

I need to detect if a string contains XSS or not. In order to solve it I used that link. And this is the code I'm using:

public static boolean containsXSS(String value) {
    if (StringUtils.isEmpty(value)) {
        return false;
    }
    String stripXss = stripXSS(value);
    return !value.equals(stripXss);
}

public static String stripXSS(String value) {


 if (StringUtils.isBlank(value))
        return value;

    // Use the ESAPI library to avoid encoded attacks.
    Encoder encoder = ESAPI.encoder();
    value = encoder.canonicalize(value);

    // Avoid null characters
    value = value.replaceAll("\0", "");

    // Clean out HTML
    Document.OutputSettings outputSettings = new Document.OutputSettings();
    outputSettings.escapeMode(Entities.EscapeMode.xhtml);
    outputSettings.prettyPrint(false);
    value = Jsoup.clean(value, "", Whitelist.none(), outputSettings);

    return value;
}

Using the code above I do succeed to catch things like: <script>alert('xss')</script>

My problem is that I identify the following string as containing XSS although it's not: {"item" :5}

It's because jsoup.clean turns it into {"item" :5}

I have tried to solve but with no success. It makes me wonder if my algorithm is completely wrong (if so where can I find the algorithm to detect XSS), perhaps I don't need to compare to the original String?

I would very appreciate if you could help me.

thanks

You can’t “detect if a string contains XSS”. Escape your output properly and XSS won’t be a problem. — Ry-
– Ry- ♦, Commented Aug 22, 2017 at 18:16
How do you escape properly? is'nt there a convention? should I use only apache.StringEscapeUtils.escapeHtml ? — wantToLearn
– wantToLearn, Commented Aug 22, 2017 at 19:03

Erlend · Accepted Answer · 2017-08-22 21:52:18Z

2

You cannot detect if a string contains XSS. XSS in an output issue, not an input issue. Data benign in one context, can cause malicious behaviour in another.

Validate data using white lists to ensure data is valid in your domain (numbers are numbers, names do not contain unwantef characters etc.). This will stop some but definitely not all attacks.
Contextually encode user provided output as explained in the OWASP XSS prevention cheat sheet
Dont mix client side and server side templates
Be careful when using unsanitized data in javascript (see DOM-based XSS)

answered Aug 22, 2017 at 21:52

Erlend

4,40625 silver badges26 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Marged Over a year ago

owasp.org/index.php/OWASP_Java_HTML_Sanitizer_Project contains information about the sanitizers provided by OWASP plus links to the cheat sheet you named

Collectives™ on Stack Overflow

How to detect XSS in Java using OWASP

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related