My application is dynamically constructing a source URL and then writing the resource file (Excel) directly to the response. The URL is read from a properties file, based on the application environment. (Not related to user input!)

Our scanning tool is reporting a XSS vulnerability on BufferedOutputStream.write(): "Improper Neutralization of Script-Related HTML Tags in a Web Page".

  • Is this a valid error?
  • If so, how can I protect the user from this?

I believe the Excel data will be XML, so it would not be possible to strip out tags.

public void doGet(HttpServletRequest req, HttpServletResponse res)
    throws ServletException, IOException


    HttpSession session = req.getSession();
    OutputStream os = res.getOutputStream();
    BufferedOutputStream ros = null;
    InputStream iStr = null;
    BufferedInputStream bistr = null;

        ros = new BufferedOutputStream(os);
        URL location = new URL(resourceName);
        URLConnection input = location.openConnection();//remote excel file

        int len = input.getContentLength();

        iStr = input.getInputStream();
        bistr = new BufferedInputStream(iStr);

        byte[] buffer = new byte[len];
        int bytesRead = 0;
        while(-1 != (bytesRead = bistr.read(buffer, 0, buffer.length)))
            ros.write(buffer, 0, bytesRead);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.