0

I have gone through the couple of online references for prevention of XSS and was able to resolve issue related to JSP by using JSTL tag / fn:escapeXml() EL function when displaying user-controlled input.

Though I am unable to figure out how the following piece of code is causing XSS vulnerability

Line of code which is causing XSS vulnerability :

         if(div == null)
            out.println("\twindow.scroll(0, "+value+");");
        else
            out.println("\tdocument.getElementById('"+div+"').scrollTop = "+value+";");

Complete block of code:

        out.println("<SCRIPT type=\"text/javascript\">");
        out.println("function scrollAfterLoad()");
        out.println("{");
        //out.println("\talert('scrollAfterLoad('+y+')');");

        // If the id of a DIV is specified, we will scroll that DIV,  otherwise we scroll
        // the entire window
         if(div == null)
            out.println("\twindow.scroll(0, "+value+");");
        else
            out.println("\tdocument.getElementById('"+div+"').scrollTop = "+value+";");

        out.println("\tbodyDiv = document.getElementById(\"body\");");
        out.println("\tif(bodyDiv != null)");
        out.println("\t\tsetTimeout('bodyDiv.style.visibility = \"visible\";', 0);");
        out.println("}");

Here "div" and "value" are string variable and the above piece of code is in TagHandler class

3
  • If the value comes from user input, the user can input JavaScript code for the value and that code will be executed in the page.
    – Can't Tell
    Feb 2, 2015 at 11:18
  • Its hard to provide a definitive answer to this question. Basically vulnerabilities come from outside entities being able to influence what your application does. In this case especially if 'value' comes from the HTTP request, then the entity generating the request or a man in the middle can manipulate 'value' to contain more than is intended, such as added javascript.
    – Gimby
    Feb 2, 2015 at 11:54
  • As mentioned in the post, the above piece of code is in Tag Handler class inside doStartTag() method. Here the "value" which is a string variable should contain only alphabets. Now if the validate this "value" to contain only alphabets using regex, will this help me in preventing XSS vulnerabilities
    – SHV
    Feb 3, 2015 at 12:02

1 Answer 1

-1

You can use enterprise security api like below:

ESAPI.encoder().encodeForJavaScript("dynamic value");

Refer to this: https://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.