Solved

Java Library to fix XSS (Cross-site Scripting) for rich data

Posted on 2009-06-29
9
929 Views
Last Modified: 2013-11-19
I have a web application written in Java and JSP. I am using Apache JServ server and not using any web frame works like Struts or Spring MVC.

I would like to fix the XSS issue reported by IBM AppScan. We allows the users to enter rich data (HTML).

Can anyone suggest the best way to fix this vulnerability?
Please suggest any libraries availble for this.

Thanks
0
Comment
Question by:Gibu George
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 2
9 Comments
 
LVL 2

Expert Comment

by:mhaq_java
ID: 24734334
call a javascript on all entry points where data is added and replace special characters like >< ' " with their html codes
0
 
LVL 12

Author Comment

by:Gibu George
ID: 24734557
As I mentioned in my question, we allows the user to enter HTML tags such as <b>, <br> etc and we shows the same user entered text in another read-only page. In that read-only page we would like apply the tags and show the text as bold or with line breaks. So replacing these characters with the html codes will start displaying the html codes in the read-only page.

Your thoughts?
0
Don't Cry: How Liquid Web is Ensuring Security

WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.

 
LVL 2

Expert Comment

by:mhaq_java
ID: 24734597
Well Can other users see these pages.
Like a forum if one has posted a commentt all else can see it. In this case it should not enter html tags.
In that case provide them with your own custom tags like [bold] [/bold]. And replace them with orginal tags at the time of saving. Only support a few tags that need presentation.
0
 
LVL 12

Author Comment

by:Gibu George
ID: 24734687
Yes. One person will be posting and others will view it in read-only format. There are many persons who has authority to post the HTML text and they are doing it for years now. Asking them to post it using custom tags will be difficult since they have to learn our custom tags, but in case of HTML tags we dont have to teach them our custom tags. There are many posting already with HTML content and stored in our DB.

Your thoughts?
0
 
LVL 2

Accepted Solution

by:
mhaq_java earned 250 total points
ID: 24734754
There is no problem with already entered data. if will remain same.
1) But you can provide icons of Bold italic & underline etc. When user click on it you place custom tag on the current location of the cursor.
it will reduce the learning time of users.


2)There is an open source component FCKEditor use that editor. It is a rich text box and will help you with formatting. It also looks like MS word. So no need for users learning. And then replace html tags with html code
0
 
LVL 2

Expert Comment

by:mhaq_java
ID: 24734806
it is how it will look like
editor.jpg
0
 
LVL 12

Assisted Solution

by:jahboite
jahboite earned 250 total points
ID: 24734958
I suggest having a look at OWASPs Enterprise Security API:
https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=Java_EE
0

Featured Post

Learn by Doing. Anytime. Anywhere.

Do you like to learn by doing?
Our labs and exercises give you the chance to do just that: Learn by performing actions on real environments.

Hands-on, scenario-based labs give you experience on real environments provided by us so you don't have to worry about breaking anything.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to count occurrences of each item in an array.

717 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question