Databases
StackOverflow2013
Postsdbo
POHow to fix endemic XSS vulnerabilities in a Java webapp
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POHow to fix endemic XSS vulnerabilities in a Java webapp
    primarykey
    data
    text
    <p>I am working on a Java web application that is many years old.</p> <p>Most of the <code>&lt;bean:write&gt;</code>s in the JSPs have <code>filter="false"</code> even when it isn't needed, probably because of developers blindly copying existing code. <code>&lt;bean:write&gt;</code> is the Struts tag to output a JSP variable, and when <code>filter="false"</code> is specified it does not do HTML escaping (so <code>filter="false"</code> is similar to the <code>&lt;c:out&gt;</code> attribute <code>escapeXml="false"</code>). This means that the application is vulnerable to XSS attacks, because some of these <code>&lt;bean:write filter="false"&gt;</code>s are outputting user input.</p> <p>A blanket removal of <code>filter="false"</code> isn't an option because in some cases the application allows the user to enter HTML using a TinyMCE text area, so we do need to output raw HTML in some cases to retain the user-entered formatting (although we should still be sanitising user-entered HTML to remove scripts).</p> <p>There are thousands of <code>filter="false"</code>s in the code so an audit of each one to work out whether it is required would take too long.</p> <p>What we are thinking of doing is making our own version of the <code>bean:write</code> tag, say <code>secure:write</code>, and doing a global find/replace of bean:write with secure:write in our JSPs. <code>secure:write</code> will strip scripts from the output when <code>filter="false"</code> is specified. After this change users would still be able to cause formatting HTML to be output where they shouldn't really be able to, but we aren't worried about that for the time being as long as the XSS vulnerabilities are fixed.</p> <p>We would like to use a library to implement the script-stripping in the <code>secure:write</code> tag and we have been looking at <a href="https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project" rel="nofollow">https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project</a> and <a href="https://code.google.com/p/owasp-java-html-sanitizer/" rel="nofollow">https://code.google.com/p/owasp-java-html-sanitizer/</a>. Both look like they are capable of sanitising HTML, although AntiSamy looks like it is intended to be used to sanitise HTML on the way in to the application instead of on the way out, and since data is output more often than it is input we are concerned that running all of our <code>secure:write</code> output through it could be slow.</p> <p>I have 2 main questions:</p> <p>1) Will our proposed approach work to fix the XSS vulnerabilities caused by <code>filter="false"</code>?</p> <p>2) Can anyone recommend a library to use for HTML sanitisation when displaying content, i.e. which is fast enough to not significantly affect the page-rendering performance? Has anyone used AntiSamy or owasp-java-html-sanitizer for something similar?</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. USfrankoid
    1. USfrankoid
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POHow to fix endemic XSS vulnerabilities in a Java webapp
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POHow to fix endemic XSS vulnerabilities in a Java webapp
      1. USMartin Wilson
      1. VTFavorite
    3. VO
      singulars
      1. POHow to fix endemic XSS vulnerabilities in a Java webapp
      1. This table or related slice is empty.
      1. VTUpMod
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload