Proper way to assign json object of request attribute to java script variable in jsp using jstl tags

Question

My application is submitting to veracode to identify flaws. I am facing strange issue. Please check below code of my jsp.

<script type="text/javascript">

    //My code Before veracode static scan
    var userObj = ${userObj};
    var settingsObj = ${settingsObj};

    //I changed like below it is working, but veracode scan giving error.
    var userObj = <%= request.getAttribute("userObj") %>;
    var settingsObj = <%= request.getAttribute("settingsObj") %>;

    //My code after veracode static scan. veracode scan raised issue with above code so i fixed like below.
    var userObj = '<c:out value="${userObj}"/>';
    var settingsObj = '<c:out value="${settingsObj}"/>';
</script>

I have two objects userObj, settingsObj both are jsons objects. we will send these objects as request attribute. When i am assigning request attribute like ${var}, it is assigning as json object and working as expected. If i assign from jstl tag it is not working as expected. It is escaping string like below.

variable value with ${attrName} and <%= request.getAttribute("attrName") %>

{"userName":"st_user"}

variable value with c:out

{&#034;userName&#034;:&#034;st_user&#034;}

How i can assign json object to javascript variable using with out escaping and with out any extra parsing.

@JasperdeVries, with `${}` veracode throwing **XSS** issue. so i am using `c:out` — user_27, Feb 27 '18 at 05:28
how i unescape escaped json string in jsp, Check the above responses? — user_27, Feb 27 '18 at 08:43
Possible duplicate of [Access Java / Servlet / JSP / JSTL / EL variables in JavaScript](https://stackoverflow.com/questions/3832792/access-java-servlet-jsp-jstl-el-variables-in-javascript) — Jasper de Vries, Feb 27 '18 at 08:46
See also https://stackoverflow.com/questions/6617155/escape-javascript-in-expression-language — Jasper de Vries, Feb 27 '18 at 08:47
By the way, if you are using something like GSON it will take care of the escaping for you. — Jasper de Vries, Feb 27 '18 at 09:24

Proper way to assign json object of request attribute to java script variable in jsp using jstl tags

0 Answers0