0

I have below code to avoid xss-prevention

Issues but seems it's not working

<TD width="100%" class="InputColumn" colspan="2">
<TEXTAREA NAME="txt_name" ROWS="9" COLS="178"fld="ccom" onblur="javascript:trimInnerSpaces(this)"onchange="javascript:setccomSaveFlag();"><%=ESAPI.encoder().encodeForHTML(StUpCom)%></TEXTAREA>
</TD>
Vojtech Ruzicka
  • 16,384
  • 15
  • 63
  • 66
kpatel97
  • 1
  • 1
  • How is it not working? Is it crashing, or is it just not doing what you want? – GHC Mar 18 '15 at 07:49
  • http://stackoverflow.com/a/2658941/1140748 – alain.janinm Mar 18 '15 at 07:58
  • possible duplicate of [XSS prevention in Java](http://stackoverflow.com/questions/2658922/xss-prevention-in-java) – alain.janinm Mar 18 '15 at 07:59
  • its working fine but not able to prevent xss issues – kpatel97 Mar 18 '15 at 08:00
  • Unrelated: for escaping HTML see JSTL `c:out` http://docs.oracle.com/javaee/5/tutorial/doc/bnakh.html – Jasper de Vries Mar 18 '15 at 08:16
  • Looks like you have javascript code working with your textarea. In such case encodeForHTML() is not enough to prevent XSS. You may need additionally to use encodeForJS(). See this guide: https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet – mies Mar 23 '15 at 10:24
  • Anyway it would be easier to answer if you provide the xss attack example that breaks your code. – mies Mar 23 '15 at 10:26

0 Answers0