5

I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this:

<td>${customer.notes}</td>

It was fixed by escaping the user controlled input, the resulting code looks like this:

<td><c:out value="${customer.notes}"/></td>

JSP, and other templating frameworks I have used, always default to only escaping dynamic data when specifically requested to, and not escaping by default.

The inverse of this is clearly a far more secure default, ie. all dynamic data is escaped, unless you specifically tell the framework not to.

Are there any frameworks that work this way? Is there a major issue in changing future frameworks to behave this way? Obviously you incur the over-head of escaping data that may not necessarily be user controlled, but if you run into performance issues, you can disable it wherever safe. Is there something I'm missing?

2
  • Rails does. If you want to add unescaped HTML to a page with Rails you have to explicitly declare it as HTML safe.
    – Ajedi32
    Jun 10, 2016 at 15:17
  • JSP not only doesn't auto-escape HTML, but makes it wackily difficult to escape HTML: the syntax is different if you want to escape a value in an element attribute, and the rules for when to escape when you're using JSP tags are surprising. Pebble (github.com/PebbleTemplates/pebble) seems to be a more sane templating system in the Java ecosystem in my experience with it.
    – Macil
    Oct 31, 2018 at 4:20

1 Answer 1

5

Are there any frameworks that work this way?

Sure. Twig or Django would be two examples.

The inverse of this is clearly a far more secure default, ie. all dynamic data is escaped, unless you specifically tell the framework not to.

Yes, this is a lot more secure.

Is there something I'm missing?

The one downside is that XSS is context-sensitive. Default encoding may not be enough[*], and it may thus lead to a false sense of security.

On the other hand, just HTML-encoding ', ", <, and > will catch the vast majority of XSS vulnerabilities, so I would say that it is always a good idea to encode by default and provide an option to disable the encoding by default if needed.

Why don't web templating frameworks HTML escape all data by default?

JSP for example is from 1999. XSS wasn't even called XSS until 2000. My feeling is that newer engines are more likely to encode per default, because the prominence of XSS is higher, and more care is put on security (by default). Older engines likely do not want to break backwards compatibility and thus do not change the existing behavior.

[*] very simple example: <script>var x = foo.[USERINPUT]();</script>.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.