OutputStream.write（）期间的持久性XSS攻击

Question

I have been working over the security issue regarding the persistent-XSS attack and i was able to analyze the issue using fortify.

sends unvalidated data to a web browser , which can result in the browser executing malicious code.

Code is in Java.

void output(OutputStream out){
  out.write(byteData);  //byteData is a data member of the class of type byte[].
}

At line (2) in above snippet i am getting the notification of xss attack. So how can i validate it?

Answer 1

You have to validate your data before sending it to your OutputStream

void output(OutputStream out) {
    // Validate byteData code here
    out.write(byteData);
}

Validation means checking if the code abides by the rules that you want to set for it. For example, if you want to send only numbers, you can make sure that your byteData contains only numbers before sending it.