I needed to stop an XSS attack from happening when the payload is inserted into the URL as a parameter. In this case though, there are no
script tags. This is my URL which causes an XSS attack:
When I hit enter after typing this into my browser, an alert dialog saying "1" popped up. When I clicked "OK" on that, the alert dialog saying "2" came up.
I am using JSP's, so in file.jsp, I grab those parameters I passed in:
<% // Get url parameters String lTestParm1 = myObj.retrieveString( "testParm1" ); String lTestParm2 = myObj.retrieveString( "testParm2" ); %>
testParm1=<script>alert('hey')</script> into the URL), but I can't do that since there are no
Now in the JS portion of the code also in file.jsp:
I put a couple comments beside the 2 lines where I think the problem is.
To try and stop this XSS attack, I replaced each apostrophe with 2 apostrophe's in the URL. This seemed to work for this case.
I couldn't find any other articles/questions relating to this problem, but I did find similarities with SQL injection apostrophe replacement questions. They said that there are still many ways to get past apostrophe replacement by itself.
Here's a link to one of the questions: https://stackoverflow.com/questions/15537368/how-can-sanitation-that-escapes-single-quotes-be-defeated-by-sql-injection-in-sq
This made me wonder if my solution is sufficient enough, or if there are still ways to perform an XSS attack even with my apostrophe replacement in place.