Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Java Library to fix XSS (Cross-site Scripting) for rich data

Posted on 2009-06-29
9
Medium Priority
?
933 Views
Last Modified: 2013-11-19
I have a web application written in Java and JSP. I am using Apache JServ server and not using any web frame works like Struts or Spring MVC.

I would like to fix the XSS issue reported by IBM AppScan. We allows the users to enter rich data (HTML).

Can anyone suggest the best way to fix this vulnerability?
Please suggest any libraries availble for this.

Thanks
0
Comment
Question by:Gibu George
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 2
9 Comments
 
LVL 2

Expert Comment

by:mhaq_java
ID: 24734334
call a javascript on all entry points where data is added and replace special characters like >< ' " with their html codes
0
 
LVL 12

Author Comment

by:Gibu George
ID: 24734557
As I mentioned in my question, we allows the user to enter HTML tags such as <b>, <br> etc and we shows the same user entered text in another read-only page. In that read-only page we would like apply the tags and show the text as bold or with line breaks. So replacing these characters with the html codes will start displaying the html codes in the read-only page.

Your thoughts?
0
Looking for the Wi-Fi vendor that's right for you?

We know how difficult it can be to evaluate Wi-Fi vendors, so we created this helpful Wi-Fi Buyer's Guide to help you find the Wi-Fi vendor that's right for your business! Download the guide and get started on our checklist today!

 
LVL 2

Expert Comment

by:mhaq_java
ID: 24734597
Well Can other users see these pages.
Like a forum if one has posted a commentt all else can see it. In this case it should not enter html tags.
In that case provide them with your own custom tags like [bold] [/bold]. And replace them with orginal tags at the time of saving. Only support a few tags that need presentation.
0
 
LVL 12

Author Comment

by:Gibu George
ID: 24734687
Yes. One person will be posting and others will view it in read-only format. There are many persons who has authority to post the HTML text and they are doing it for years now. Asking them to post it using custom tags will be difficult since they have to learn our custom tags, but in case of HTML tags we dont have to teach them our custom tags. There are many posting already with HTML content and stored in our DB.

Your thoughts?
0
 
LVL 2

Accepted Solution

by:
mhaq_java earned 1000 total points
ID: 24734754
There is no problem with already entered data. if will remain same.
1) But you can provide icons of Bold italic & underline etc. When user click on it you place custom tag on the current location of the cursor.
it will reduce the learning time of users.


2)There is an open source component FCKEditor use that editor. It is a rich text box and will help you with formatting. It also looks like MS word. So no need for users learning. And then replace html tags with html code
0
 
LVL 2

Expert Comment

by:mhaq_java
ID: 24734806
it is how it will look like
editor.jpg
0
 
LVL 12

Assisted Solution

by:jahboite
jahboite earned 1000 total points
ID: 24734958
I suggest having a look at OWASPs Enterprise Security API:
https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API#tab=Java_EE
0

Featured Post

Cyber Threats to Small Businesses (Part 1)

This past May, Webroot surveyed more than 600 IT decision-makers at medium-sized companies to see how these small businesses perceived new threats facing their organizations.  Read what Webroot CISO, Gary Hayslip, has to say about the survey in part 1 of this 2-part blog series.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

An introduction to the wonderful sport of Scam Baiting.  Learn how to help fight scammers by beating them at their own game. This great pass time helps the world, while providing an endless source of entertainment. Enjoy!
The recent Petya-like ransomware attack served a big blow to hundreds of banks, corporations and government offices The Acronis blog takes a closer look at this damaging worm to see what’s behind it – and offers up tips on how you can safeguard your…
The viewer will learn how to look for a specific file type in a local or remote server directory using PHP.
Learn how to create flexible layouts using relative units in CSS.  New relative units added in CSS3 include vw(viewports width), vh(viewports height), vmin(minimum of viewports height and width), and vmax (maximum of viewports height and width).

604 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question