How to prevent an XSS attack
I was told by the penetration testing team that the below url is causing an XSS attack -
Here is my download_msg.jsp code
<% String download_msg = null;
if (session == null || session.getAttribute("user") == null) {
download_msg = "Error message";
} else {
download_msg =
(OLSUser)session.getAttribute("user")).getReportInfo().getDownloadMsg();
}
%>
<html>
<head>
<SCRIPT LANGUAGE='JavaScript' SRC='/Test/test.js'></SCRIPT>
<SCRIPT LANGUAGE='JavaScript'>init('StmsReps');</SCRIPT>
<script language="JavaScript">
function redirect() {
if (window.focus)
self.focus();
this.location = "/test/DownloadReport?<%=request.getQueryString()%>";
}
</script>
<title>XSS</title>
</head>
<body marginwidth='0' marginheight='0' onload='javascript:redirect()'>
<table width='90%' height='100%' align='center' border='0' cellspacing='0'
cellpadding='0'>
<tr>
<td align='center' class='header2'> <%= download_msg %></td>
</tr>
</table>
</body>
</html>
I found that jstl can handle XSS attack. Can you advise if doing below will be fine or should I do something else?
<c:out value="<%= download_msg %>" escapeXml="true"/>
+2
a source to share
1 answer
No. Not enough
this.location = "/test/DownloadReport?<%=request.getQueryString()%>";
An attacker could send a link with a query string like
?</script><script>alert(1337)//
or
?%22/alert('Pwned')
naive users who can click the link and execute the inline code.
You must apply appropriate escaping policies wherever untrusted input is interpolated into a template.
I can't test these lines against your setup, obviously and they might not work if you test them as browsers often do some sort of query string normalization, but you shouldn't rely on this to protect you from HTML metadata, characters in strings request.
+1
a source to share