Cross site scripting issue in jsp

Asked Feb 18 '18 at 09:12

Active Feb 18 '18 at 10:57

Viewed 283 times

How to resolve xss issue on

I have tried like below in sample.jsp

form:options items="${some} htmlescape=true

still xss issue exists.

If tried like below in sample.jsp

form:options items="${fn.escapeXml(some)}

now xss issue no more exsits but then application is not working for this page sample.jsp...showing like invalid type of string for option items. Any help is appreciated.. Thanks in advance.

edited Feb 18 '18 at 10:57

asked Feb 18 '18 at 09:12

Priyanka

We are using ${obj.name} where obj is the class name of getter and setter methods and name is the string parameter.iam not sure abt the freemarker. – Priyanka Feb 18 '18 at 12:33
See https://stackoverflow.com/questions/2658922/xss-prevention-in-jsp-servlet-web-application – Ori Marko Feb 18 '18 at 12:34
The suggestion also throw error invalid type of string for option items...as it is not value parameter in form...iam using items parameter in form:options tag.. – Priyanka Feb 18 '18 at 12:43
Issue resolved...thanks user – Priyanka Feb 19 '18 at 07:18
@Priyanka can you please post an answer to this question. – yogidilip Jun 20 '18 at 21:40

Cross site scripting issue in jsp

0 Answers0