I'm having a Spring Web Application that exposes REST APIs.
I have implemented XSS filter using Jsoup that strips the input using
The penetration testing team raised a concern where the input field content is URL encoded, the XSS filter does not strip the data and allow the input to pass to the controller.
The input for the was:
%3Cscript%3Ealert%285%29%3C%2Fscript%3E which is
The usage of the input is: we are calling with this input to a 3rd party API that returns the field as it is, and we are returning it to the client (encoded as it came).
Is it an issue?
If so, what is the practice of catching such cases where we can't know if the input is URL encoded?