I recently discovered an XSS vulnerability in an application that uses JSP to render pages. The vulnerable code in the JSP was something like this:
It was fixed by escaping the user controlled input, the resulting code looks like this:
JSP, and other templating frameworks I have used, always default to only escaping dynamic data when specifically requested to, and not escaping by default.
The inverse of this is clearly a far more secure default, ie. all dynamic data is escaped, unless you specifically tell the framework not to.
Are there any frameworks that work this way? Is there a major issue in changing future frameworks to behave this way? Obviously you incur the over-head of escaping data that may not necessarily be user controlled, but if you run into performance issues, you can disable it wherever safe. Is there something I'm missing?