Can “c:set” cause Cross Site Scripting (XSS) vulnerability?

Question

Can this be exploited as XSS vulnerability using urls like localhost/?myVar=<script>alert(document.cookie)</script> or though any other possibility?

<c:set var="myVar" value="<%=request.getParameter(\"myVar\")%>"/>
<c:if test="${myVar == 'VALUE1'}">
   <option value="a">A</option>
   <option value="b">B</option>
</c:if>
<c:if test="${myVar == 'VALUE2'}">
   <option value="c">C</option>
   <option value="d">D</option>
</c:if>

How can we secure ourself from this?

Answer 1

No, your code is fine.

Cross Site Scripting requires

1. untrusted input to be
2. interpreted as code in the browser.

Your code is safe, because it does not reflect the untrusted input (myVar) back into the generated HTML.

To see XSS in action, just add <%=myVar %> at the end of your code snippet. There it is: Reflected XSS

Answer 2

From what I see, unless you've output that myVar to the page or its applied to any other page, I do not believe so. I'm not a java expert but please correct my understanding below:

If I understand correctly, you've simply taken the Request Parameter myVar and stored it in memory as myVar in your application. Using 2, if statements with boolean logic to determine if the value is a whitelisted/trusted value that your application is expecting. If that's correct, the only other thing to do is fully round it out with else if and error handling where myVar isn't an expected value.

So if this parameter is captured once as an temporarily used variable and not used anywhere else but this simple use-case for A/B or C/D... then No it is not XSS vulnerable. Make sure you purge the variable later because you don't want to keep variables in memory for no reason but other than that... Good luck on your App or Homework, whichever is the case.