Timeline for How to prevent persistent XSS vulnerability with the Java Struts 1 Framework?
Current License: CC BY-SA 4.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 30, 2021 at 22:04 | comment | added | Poppy | Sounds like he's saying he can't sanitize the "input" because he doesn't have control of this data; his application (from what I understood) is ingesting data from a source that is dynamically build via user-supplied input. I would look into any sort of HTML sanitizing library, a quick Google search returned github.com/OWASP/java-html-sanitizer/tree/master. The issue is, you'll need to be sure you're properly sanitizing everywhere the data is returned, else you could have unexpected second-order issues. | |
| Jun 5, 2018 at 20:28 | comment | added | grf2018 | Finally i solved part of the problem adding JSTL, with c:out tag. | |
| Jun 5, 2018 at 19:16 | comment | added | Aulis Ronkainen | Sorry, but now you've lost me. What exactly do you mean by input and output? You should implement the sanitization code to the controller. That way whatever the user inputs to the form, the script tag won't get executed. How about adding the CSP header? Could that be a good method for you to mitigate this? | |
| Jun 5, 2018 at 12:13 | comment | added | grf2018 | I m sanitize the ouput with JSTL, but not able to sanitize the input :/ | |
| Jun 4, 2018 at 9:25 | comment | added | Aulis Ronkainen | Are you now able to sanitize the output? | |
| Jun 1, 2018 at 3:47 | history | edited | Aulis Ronkainen | CC BY-SA 4.0 |
added 4 characters in body
|
| Jun 1, 2018 at 3:19 | comment | added | Aulis Ronkainen | I edited my answer. | |
| Jun 1, 2018 at 3:18 | history | edited | Aulis Ronkainen | CC BY-SA 4.0 |
added 339 characters in body
|
| May 31, 2018 at 20:19 | comment | added | grf2018 | Thank you for your reply, but the problem here is that I can't find a way to sanitize with that tag.<html:text ......./> | |
| May 31, 2018 at 19:52 | history | answered | Aulis Ronkainen | CC BY-SA 4.0 |