如何在我的JAVA Tomcat Web应用程序中阻止El-Tags

Question

I've came across the problem of EL (expression-language) injection in my Java Tomcat application. i have tried to solve it in the web.xml file using:

<jsp-config>
    <jsp-property-group>
        <url-pattern>*.jsp</url-pattern>
        <el-ignored>true</el-ignored>
         <scripting-invalid>true</scripting-invalid>
    </jsp-property-group>
</jsp-config>

and with the suggestion in the following article: https://www.aspectsecurity.com/uploads/downloads/2012/12/Remote-Code-with-Expression-Language-Injection.pdf

<context-param> 
 <description>Spring Expression Language Support</description> 
 <param-name>springJspExpressionSupport</param-name> 
 <param-value>false</param-value> 
</context-param>

However neither of them seem to work. i have tested it with the following .jsp file:

request param is: ${param.name} 

and typed in the URL:

http://<myURL>/<myPath>/test.jsp?name=blablabla

the output to the screen was

request param is: blablabla

while i was expecting it to be:

request param is: ${param.name}

after my changes. Any suggestions?

Answer 1

Well problem solved. In case someone will run into it the future: The solution is to add to the web.xml:

<jsp-config>
    <!-- Set to true to disable JSP scripting syntax -->
    <jsp-property-group>
        <url-pattern>*.jsp</url-pattern>
        <scripting-invalid>true</scripting-invalid>
    </jsp-property-group>
    <!-- Set to true to disable Expression Language (EL) syntax -->
    <jsp-property-group>
        <url-pattern>*.jsp</url-pattern>
        <el-ignored>true</el-ignored>
    </jsp-property-group>
</jsp-config>