37

I have the following line of code in a JSP File in my web app that is giving an error:

<jsp:setProperty name="db" property="userName" value="<%=request.getParameter("userName")%>"/>

The error message that I get is:

org.apache.jasper.JasperException: /loginbean.jsp(6,59) Attribute value request.getParameter("userName") is quoted with " which must be escaped when used within the value

What I read on some sites is that characters like ' (single quote) or " (double quote) need to be prefixed with an escape sequence \ (backslash) if they are to be used.

However, when I try and prefix the double quotes (around the word userName) with backslash, I immediately get the following error- "Illegal Character \92- Unclosed String Literal"

How do I resolve this problem?

1

7 Answers 7

57

You should use single quotes on the value parameter, ie:

value='<%=request.getParameter("userName")%>'

or set the org.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING parameter to false as described here:

http://blogs.sourceallies.com/2009/10/strict-quote-escaping-in-tomcat/

2
  • I tried with single quotes- I am getting the following error now- org.apache.jasper.JasperException: org.apache.jasper.JasperException: Can't find a method to write property 'userName' of type 'java.lang.String' in a bean of type 'logbean.LoginBean'
    – Arvind
    Jun 28, 2011 at 8:21
  • Set also stackoverflow.com/questions/9878326/… on how to set this for jasper ant task
    – Vadzim
    Dec 6, 2016 at 22:38
12

If you are using Tomcat 8.5+, the property org.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING=false will not be acknowledged.

I was able to set the property successfully in {TOMCAT_ROOT}/conf/web.xml by adding the following within the <servlet> block:

<init-param>
    <param-name>strictQuoteEscaping</param-name>
    <param-value>false</param-value>
</init-param>
1
  • 2
    By default, there are two servlet elements in web.xml. You need to place the above init-param element in the <servlet-name>jsp</servlet-name> Apr 4, 2017 at 11:04
9

If you don't want to modify your JSPs, just set:

org.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING=false

in your {TOMCAT_ROOT}/conf/catalina.properties file. Works like a charm!

Kudos from here.

0
6

This can be fixed with a IDE Regexp Replace:

(<\w+:(?:[^>]|<%=[^%]+%>)+=)"([^<"]*<%=[^%]*"[^%]*%>[^"]*)"

For the replacement text, enter:

$1'$2'

4
  • 4
    +1 Pretty impressive. Not readable or anything, but impressive.
    – Ron Romero
    Dec 26, 2011 at 23:28
  • instead of replacing with single quotes, I want to replace with escaping the inner double-quotes. what should be my regex and replacement text here.
    – thiru_k
    Oct 4, 2013 at 9:39
  • I have gained a lot of time ! It what i was looking for !
    – amdev
    Dec 20, 2016 at 10:14
  • @thiru_k had the same issue, here is a regex for future reference (?<=<%=.*)(?!\\)"(?=.*%>) replacing with \\"
    – Vinz243
    Feb 11, 2021 at 14:37
1

The example looks like a XSS example! This is a security vulnerability. I suggest to put in place a html encoding library like c:out tag or http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/esapi/Encoder.html#encodeForHTMLAttribute%28java.lang.String%29

I also suggest to take the userName from an authenticated session and not form the request param if possible (unless this is a login/registration form only!)

0

if you use a " as scriplet delimeter, you can't use the some as a property delimiter in getParameter. So change the delimeter of scriptlet by '.As it tag parameter, I think there 'll be no problem. Otherwise replace :

value="<%=request.getParameter("userName")%>"/>

by :

value='<%=request.getParameter("userName")%>'/>

0

I case Jasper JSP validation phase is used during project build.

Since Tomcat 8 there is a new attribute strictQuoteEscaping for Ant task and a switch -no-strictQuoteEscaping for running org.apache.jasper.JspC from command line.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.