在 BufferedReader readLine() 方法上反射 XSS

Question

I have scanned a java web project with the Checkmarx tool, and the analysis marks an XSS vulnerability in a method where a web service is executed that responds a JSON, the vulnerability is in the line while((output = Encode.forJava(br.readLine())) != null) { , specifically in br.readLine() .

Checkmarx says:

The attacker would be able to alter the returned web page by simply providing modified data in the user input readLine , which is read by the NetClientPost method. This input then flows through the code straight to the output web page, without sanitization. This can enable a Reflected Cross-Site Scripting (XSS) attack.

I tried with OWASP for Java, implementing the method Encode.forJava() , but the vulnerability continues to appear in the analysis. This is the implementation of the method:

public String NetClientPost (String urlSer, String param){
        String result ="";
        try {
            InetAddress ip = InetAddress.getLocalHost();
            String host = ip.getHostAddress();
            doTrustToCertificates();
            URL url = new URL(urlSer);
            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
            conn.setDoOutput(true);
            conn.setRequestMethod("POST");
            conn.setRequestProperty("Content-Type", "application/json");
            conn.setConnectTimeout(2000);
            String input = param;
            String output = "";

            try(OutputStream os = conn.getOutputStream()) {
                os.write(input.getBytes());
                os.flush();
                if (conn.getResponseCode() != 200) {
                    throw new RuntimeException("Failed : HTTP  code : " + conn.getResponseCode());
                }
                
                try (BufferedReader br = new BufferedReader(new InputStreamReader((conn.getInputStream())))) {
                    while ((output = Encode.forJava(br.readLine())) != null) {//LINE OF CHECKMARX XSS
                        result += output;
                    }
                }
            }
            
            conn.disconnect();
            return result;

        } catch (MalformedURLException e) {
            return result;
        } catch (IOException e) {
            return result;
        } catch (Exception e) {
            return result;
        }
    }

Any have an idea of how to solve this?

Answer 1

Try parsing the incoming data as JSON and then serializing it back to a string before sending it on.

That way you can be sure that your method only returns JSON to the client. If for some reason, your incoming data isn't JSON, then your method would encounter an error parsing the JSON, which you can then handle appropriately.

Encode.forJava isn't a helpful method to use here: it is used to encode a string to be inserted into a Java string literal.

Answer 2

output = Encode.forHtmlAttribute(br.readLine() works for me