未检测到 OWASP ESAPI XSS 攻击

Question

In a web project we use ESAPI validator to detect XSS attacks using antisamy XML file. While most of the attacks are detected as expected, it fails to detect the below given input as an XSS attack.

<img src=x onerror=alert(1) alt=

Potentially, the browser closes the tag itself, hence triggering the alert function.

Surprisingly, ESAPI detects the below given input as an XSS attack:

<img src=x onerror=alert(1) alt="text"

The backend has been written in Java and the UI in JavaScript. Antisamy file used:

https://github.com/OWASP/EJSF/blob/master/esapi_master_FULL/antisamy-esapi.xml

I also tried using the myspace antisamy file, but the problem still persists.

Can someone please help me with the reason for the difference in behavior or how to mitigate the problem?

Thanks.

Answer 1

It also would help for us to know which version of ESAPI you were testing this with as different versions use different versions of AntiSamy. (In fact, there is a new 1.6.0 version coming out shortly, after which we expect to release a new ESAPI point release.) But knowing the ESAPI version (or more specifically, the AntiSamy version) would allow us to make sure that this isn't a bug in AntiSamy.