Prevent XSS/Cross site scripting vulnerability - request.getParameter() in JSP

Question

I am looking to remediate the JSP page which has multiple variable with request.getParameter(). Can you please suggest whats the replacement for this.

 <%
if(appStatusId == AppCon.DECLINED) {
                String VPC = request.getParameter(constants.PRODUCT_CODE);
        %>


String Make = request.getParameter(constants.VEH_MAKE);

String NewUsed = request.getParameter(constants.VEH_NEWUSED);

Yeti · Accepted Answer · 2023-03-31 11:27:30Z

3

When handling untrusted user input (like the values from request.getParameter() you should always escape the input before displaying it.

Use a utility class like StringEscapeUtils (from Apache Commons Text) to escape the data instead of escaping it by your own.

For your example it would look like this:

String myVariable = StringEscapeUtils.escapeHtml4(request.getParameter("myParameter")

You can find background information about escaping at the OWASP website C4: Encode and Escape Data

edited Mar 31, 2023 at 11:27

answered Nov 23, 2021 at 22:49

Yeti

1,1601 gold badge19 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

codeG Over a year ago

Thank you this worked

Collectives™ on Stack Overflow

Prevent XSS/Cross site scripting vulnerability - request.getParameter() in JSP

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related