Java ESAPI IMPLEMENTATION

Question

I've a question regarding owasp ESAPI interface for xss protection.To keep it simple short and straight I'm doing a source code review using fortify. The application implement ESAPI and make call to ESAPI.encoder().canonicalize(user input) and does not do any further validation and prints the output. Is this still vulnerable to xss PS: The reflection point is inside a html element. I've gone through all the posts regarding ESAPI interface in stack overflow, but couldn't quite get it Any help would be appreciated

Let me know if any further information is required on this. Sorry if my way of presenting the question is odd. Thanks in advance — itzkmv
– itzkmv, Commented Dec 21, 2017 at 17:48
Let me know if any further information is required on this. Sorry if my way of presenting the question is odd. Thanks in advance — itzkmv
– itzkmv, Commented Dec 21, 2017 at 17:51

fgb · Accepted Answer · 2017-12-22 00:14:07Z

1

canonicalize alone doesn't prevent xss at all. It decodes data, but you want the opposite, to encode the data.

Not only does it allow content like <script>alert(1)</script> straight-through, but it also decodes <script>alert(1)</script> from a non-executable script to a executable one.

The method you want instead is encodeForHTML. This will encode the data so it can be inserted safely into an HTML context, so < will become < and so on.

Also, check if you're already doing HTML encoding by checking whether these characters are accepted. Some templating languages and tags do encoding automatically.

edited Dec 22, 2017 at 0:14

answered Dec 22, 2017 at 0:08

fgb

18.6k3 gold badges41 silver badges52 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

itzkmv Over a year ago

Have a small doubt here.here we are also calling the encoder aswell by using ESAPI.encodr(). canonicalize(). So doesn't the encoder encode the decoded output from canonicalize method

fgb Over a year ago

@itzkmv The encoder will only do encoding if you call one of the encoding methods on it. A few of the methods do decoding instead.

itzkmv Over a year ago

Have a doubt, doesn't the encodevmethod in ESAPI.encoder(). canonicalize () encode the decoded output by the canonicalize method

itzkmv Over a year ago

Thanks for concise yet precise answer

fgb Over a year ago

No, ESAPI.encoder method retrieves the encoder object. It doesn't do anything with the strings until you call the specific methods on it.

|

Collectives™ on Stack Overflow

Java ESAPI IMPLEMENTATION

1 Answer 1

8 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

8 Comments

Your Answer

Sign up or log in

Post as a guest

Related