0

My application is vulnerable to XSS attack. Technology used in the application are Servlet 2.2, JSP 1.1, Jdk 1.3, WAS 4.0. I wanted to remediate XSS vulnerability with migration of technology or remediate with the current technology. As of now i thought to migrate servlet 2.2 to 2.3 to use filter interface. Please advise what changes i need to make in the current application to migrate servlet from 2.2 to 2.3. Any other advise for remediation is also welcome.

3

Fundamentally XSS is one of:

  1. Failure of input validation
  2. Failure of output escaping

If you have well known data entry points you can potentially clean all input. If you must preserve special characters and formatting then you must also escape output. Output escaping is non-trivial and depends on the context of the output (e.g. in a link, in an anchor, in a text block, in a form field). It's well worth using a standard library to carry out this action.

This OWASP article has more information: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

A web application FW may also provide some level of protection if configured correctly depending on the nature of your data.

  • 1
    +1 - output escaping should be the primary focus with input validation as a fallback. – SilverlightFox Aug 1 '14 at 8:32
  • Agreed, but in legacy sometimes it's more tractable to clean all input...for example if there's a single point that all DB write operations go through. – Andy Boura Aug 1 '14 at 8:35
  • I have gone through the cheat sheets. None are compatible to the technology we are using. – SudhirKumar Aug 13 '14 at 7:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.