防止XSS并使用c：out jsp标记

Question

A ${book.description} variable contains text with "\\n" character incide, so I replace it to html tag to preserve new line (new paragrapf line) in jsp output. But in this case there is a danger of execution of the XSS code. Is there a way do it using c:out jsp tag and preserv new line in text? If I use c:out for output then all < br/ >replaced to & lt; br / & gt; and there is no new line.

<c:set var="newline" value="<%= \"\n\" %>" />           
<p>${fn:replace(book.description, newline, "<br />")}</p>

Answer 1

You might interested in other functions of JSTL Functions .

Have a look at ${fn:escapeXml(text)} that escapes XML characters in a string. Here is the Sample .

---

Have a look at

<c:out value="value" [escapeXml="{true|false}"] [default="defaultValue"] />

Read more tutorial on Core Tag Library

---

EDIT

Solution 1

<c:set var="newline" value="\n" />
<c:set var="text" value="abc\nlmn\nxyz" /> 
${ fn:replace(text, newline,'</br>')}

Solution 2

<c:set var="newline" value="\n" />
<c:set var="text" value="abc\nlmn\nxyz" /> 
<c:out value="${ fn:replace(text, newline,'</br>')}" escapeXml="false"/>

output:

abc
lmn
xyz