My application is vulnerable to XSS attack. Technology used in the application are Servlet 2.2, JSP 1.1, Jdk 1.3, WAS 4.0. I wanted to remediate XSS vulnerability with migration of technology or remediate with the current technology. As of now i thought to migrate servlet 2.2 to 2.3 to use filter interface. Please advise what changes i need to make in the current application to migrate servlet from 2.2 to 2.3. Any other advise for remediation is also welcome.
Fundamentally XSS is one of:
- Failure of input validation
- Failure of output escaping
If you have well known data entry points you can potentially clean all input. If you must preserve special characters and formatting then you must also escape output. Output escaping is non-trivial and depends on the context of the output (e.g. in a link, in an anchor, in a text block, in a form field). It's well worth using a standard library to carry out this action.
This OWASP article has more information: https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
A web application FW may also provide some level of protection if configured correctly depending on the nature of your data.