Struts XSS预防-防止GET XSS

Question

I have been able to prevent an XSS attack in struts 1.2 through a combination of filter="true" in the bean:write messages and by using StringEscapeUtils.escapeHtml4(string) in the tag libs I am using. However I can attack my site through an attack in the URL in the following form...

www.mysite.com/App/Start.do?logo=mylogo'><script>alert("ATTACK")</script>

Any advice on the best way to prevent this. I tried using a servlet filter but I don't want to convert all request inputs to special characters.

Answer 1

Easiest way I've found to block XSS is replacing all > , < and " characters with < , > and " before writing to the webpage. This should protect you from XSS so long as you aren't placing user input inside places such as script tags, image tags (XSS has been possible from the src= of image tags) etc as they won't be able to create their own tags.

In PHP you would do this with the htmlSpecialChars method that encodes all characters like that. However Java doesn't have this method so the quickest way is to just replace those, you should really go through the entire list yourself. Shouldn't be too hard to implement 5 replaceAll()

---

The docs for the StringEscapeUtils method your using claims to perform what I suggest above, so you should check that your using the method correctly as your example shouldn't survive this form of prevention.