-3

I have a project with Java, I found a Vulnerability and tried to solve it using ESAPI, but when I execute it I found the following problem:

I added this code:

<% import org.apache.commons.lang.StringEscapeUtils;%>

This code-making problem and the rest of the code depends on it. the first code is :

boolean bReportFormat=(request.getParameter("reportFormat")!=null);
f.setGroupingUsed(bReportFormat);

and the second code is:

<% import org.apache.commons.lang.StringEscapeUtils;%>
  <% String bReportFormat=(request.getParameter("reportFormat")!=null);
String input = request.getParameter("reportFormat");
String Comment = ESAPI.validator().getValidInput("reportFormat", input, "CommentRegex", 400, false, errorV);
String bReportFormat= ESAPI.encoder().encodeForHTML( Comment );



f.setGroupingUsed(bReportFormat);



%>

I am using the ESAPI as explained without adding anything else. Please who has a solution to help, and thanks.

djb
  • 4,930
  • 1
  • 34
  • 37
Mohammed
  • 1
  • 1
  • 2
  • Syntax error. Fix it. Don't post picture of text here, and especially not links to pictures of text. Post the text. – user207421 Jun 09 '16 at 21:06

1 Answers1

0

See How do you import classes in JSP? The correct syntax for an import in JSP is <%@ page import="org.apache.commons.lang.StringEscapeUtils" %> You need the page keyword and import= option, and no semicolon.

The normal <% %> syntax is for defining in-line code -- think of it as injecting code inside the body of a Java method. import statements are not allowed inside methods -- they must be done at the top of the source file. (Tomcat converts the JSP source into a Java source file.) The <% page %> directive is to emit page-level declarations such as Java import statements.

Community
  • 1
  • 1
djb
  • 4,930
  • 1
  • 34
  • 37
  • Thanks for your help . I've done what you said, but the problem is not solved Are there some files that should be added to working ESAPI? – Mohammed Jun 12 '16 at 22:21
  • @Mohammed - please include more information on what failure you are now getting. If you are seeing the same message, I believe your crosstab.jsp file did not get updated correctly on the server. – djb Jun 14 '16 at 16:16