Fix Checkmarx XSS Vulnerabilities

Question

Checkmarx is giving XSS vulnerability for following method in my Controller class. Specifically: This element’s value (ResultsVO) then flows through the code without being properly sanitized or validated and is eventually displayed to the user in method:

 @RequestMapping(value = "/getresults", method = RequestMethod.POST, produces = "application/json")
    @ResponseBody
    public ResultsVO getConfigResults(@RequestBody ResultsVO resultsVO, HttpServletRequest request)
            throws OverrideApplicationException {
        String loggedUserId = request.getHeader("USER");
        return resultsService.getConfigResults(resultsVO, loggedUserId);
    }

The ResultsVO object has a lot of String attributes and I'm just wondering is there an elegant way to encode them to prevent this vulnerabilty.

Does this answer your question? [How do I prevent people from doing XSS in Spring MVC?](https://stackoverflow.com/questions/2147958/how-do-i-prevent-people-from-doing-xss-in-spring-mvc). Since you just asking about sanitizing a `string`. — baruchiro, Feb 11 '20 at 05:06

score 5 · Answer 1 · answered Oct 01 '20 at 10:45

Try this -- It worked for me :)

resultsVO = SecurityUtil.sanitizeObject(resultsVO, ResultsVO.class);

public static <T> T sanitizeObject(Object object, Class<T> classOfT){
        Gson gson = new Gson();
        String json = Jsoup.clean(StringEscapeUtils.escapeHtml4(gson.toJson(object)), Whitelist.basic());
        return gson.fromJson(json, classOfT);
    }

Checkmarx will pass your reported issue. :)

Hope it will help - Upvote if worked

it worked for me great thanks. – Kumaresan Perumal Jul 14 '23 at 07:19 — Kumaresan Perumal, Jul 14 '23 at 07:19

score 0 · Answer 2 · answered Mar 09 '20 at 11:29

0

You to need to remove escape characters like Html/Js scripts from it. You need to use Jsoup and apache-commons library to escape Html/Javascript code.

Example:

    String loggedUserId = Jsoup.clean( 
        org.apache.commons.lang.StringEscapeUtils.escapeHtml(
        org.apache.commons.lang.StringEscapeUtils.escapeJavaScript(  
          request.getHeader("USER")
        )));

answered Mar 09 '20 at 11:29

GnanaJeyam

2,780
16
27

Question is abut resultVO flow - which is not sanitize. Your answer will helpful only if somebody want to sanitize string – StackOverFlow Oct 01 '20 at 10:47

Fix Checkmarx XSS Vulnerabilities

2 Answers2