Escape all strings in JSP/Spring MVC

Question

I display strings in my JSP this way:

${someString}

this string may, of course, contain special html characters. Currently it is possible to HTML-inject malicious code (eg. if someString is a javascript include - <script src...>).

How can I make sure that all strings are escaped before printing?

I am using Spring MVC and JSP.

Possible duplicate :http://stackoverflow.com/questions/4948532/where-should-i-escape-html-strings-jsp-page-or-servlets — Suresh Atta, Jul 29 '13 at 09:12
@JoshuaMN Use AntySami https://www.owasp.org/index.php/Category:OWASP_AntiSamy_Project — Suresh Atta, Jul 29 '13 at 09:19

score 30 · Accepted Answer · edited May 22 '17 at 11:36

You can use JSTL core :

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

Use <c:out value="${someString}"/> tag to display Strings. <c:out> escapes HTML characters so that you can avoid cross-site scripting, you can specify that by setting the attribute escapeXml=true. Another advantage is that you can also provide a default value in case the value evaluates to null.

You can also use fn:escapeXml() EL function. You need to include JSTL functions for that .

<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>

Another possible way , will be build a custom ELResolver.

Enables customization of variable and property resolution behavior for EL expression evaluation.

This blog provides a working example of how it can be done.

For the entire Spring MVC app , you can specify the escaping in the web.xml:

<context-param>
   <param-name>defaultHtmlEscape</param-name>
   <param-value>true</param-value>
</context-param>

But then the escaping applies only to the spring tags , like :

<form:input path="formField" htmlEscape="true" />

Lastly , you can try the third-party library XSSFilter.

this is good, but i'd have to scan all outputs in my JSPs. Moreover a new person may not know that this is the proper way. Any automatic/global solution? — Joshua MN, Jul 29 '13 at 09:15
I have tried to set `htmlEscape="true"` on my form but it doesn't escape script tag, any idea why? — Ondrej Tokar, Jan 14 '16 at 17:59
Great. With XSSFilter, there is now no excuse to use that bloated JSF. — Nicolas Zozol, Sep 05 '17 at 09:53

score 0 · Answer 2 · answered Sep 16 '14 at 16:18

0

You can also control this behaviour at page level using <spring:htmlEscape defaultHtmlEscape="true" />

answered Sep 16 '14 at 16:18

Simon Oualid

365
2
9

1

Look the answer of NINCOMPOOP. "But then the escaping applies only to the spring tags." – Alex78191 May 22 '17 at 09:17

score -1 · Answer 3 · answered May 10 '16 at 07:40

-1

In JSP/Java You should use this code:

In JSP/HTML:

<c:out value="TR tag </tr> Script Tag <script>alert("hello Rahul")</script>" escapeXml="true" />

answered May 10 '16 at 07:40

Rahul Gupta

19
3

Escape all strings in JSP/Spring MVC

3 Answers3

Linked