Databases
StackOverflow2013
Postsdbo
POAlternative to using c:out to prevent XSS
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POAlternative to using c:out to prevent XSS
    primarykey
    data
    text
    <p>I'm working on preventing cross site scripting (XSS) in a Java, Spring based, Web application. I have already implemented a servlet filter similar to this example <a href="http://greatwebguy.com/programming/java/simple-cross-site-scripting-xss-servlet-filter/" rel="nofollow noreferrer">http://greatwebguy.com/programming/java/simple-cross-site-scripting-xss-servlet-filter/</a> which sanitizes all the input into the application. As an extra security measure I would like to also sanitize all output of the application in all JSPs. I have done some research to see how this could be done and found two complementary options.</p> <p>One of them is the use of Spring's <code>defaultHtmlEscape</code> attribute. This was very easy to implement (a few lines in web.xml), and it works great when your output is going through one of spring's tags (ie: message, or form tags). The other option I have found is to not directly use EL expressions such as <code>${...}</code> and instead use <code>&lt;c:out value="${...}" /&gt;</code></p> <p>That second approach works perfectly, however due to the size of the application I am working on (200+ JSP files). It is a very cumbersome task to have to replace all inappropriate uses of EL expressions with the <code>c:out</code> tag. Also it would become a cumbersome task in the future to make sure all developers stick to this convention of using the <code>c:out</code> tag (not to mention, how much more unreadable the code would be).</p> <p>Is there alternative way to escape the output of EL expressions that would require fewer code modifications?</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USggreiner
    plurals
    1. This table or related slice is empty.
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POAlternative to using c:out to prevent XSS
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POAlternative to using c:out to prevent XSS
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POAlternative to using c:out to prevent XSS
      1. USRoland Illig
      1. VTFavorite
    1. This table or related slice is empty.
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload