Java中的XSS漏洞

Question

1. How to fix the below XSS vulnerability issue?

   How to secure my website from XSS vulnerability?

By adding a javascript in the URL of the website all the cookies values are being displayed.

below is a similar example of the URL which consists of a java script:

https://www.example.com/ >< script>alert(document.cookie)< / script >&UserTarget= https://www.example.com/homepageredirect.jsp

To overcome this I added the below filer in obj.conf file in webserver 7.0:

---

Input fn="insert-filter"

method="POST"

filter="sed-request"

sed="s/(<|%3c)/\\< / gi"

sed="s/(>|%3e)/\\>/gi"

---

Ever after making these changes in the obj.conf , still the issue is not fixed. Please suggest something.

Answer 1

When you print your HTML just escape the special chars in the client side (or server-side, it depends for what you are going to print it) then you will be allowed to pass any input through without the need to use awkward regex or other kind of filter.

Example: Let's say I have a variable that can receive a <script>alert( document.cookie )</script> , when I print I would do something like <div> <%= escapeHTML( dangerousVariable ) %> </div> .

Answer 2

在此URL XSS预防规则中，您可以根据需要应用规则