Struts 2 encode input parameters to avoid XSS

Question

I have an application built with Struts 2. It has some issues with Cross-site scripting (XSS) attacks. I want to encode some of the actions input parameters in a similar fashion to JSP <c:out value="${somevalue}"/> Is there any easy approach to do this in Struts 2? Java API method would do fine.

EDIT I found this one - http://www.owasp.org/index.php/Talk:How_to_perform_HTML_entity_encoding_in_Java

Any experience with it?

Answer 1

You can use

<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>

${fn:escapeXml(someValue)}

---

There is also a Good API JSoup

Sanitize untrusted HTML

Problem

You want to allow untrusted users to supply HTML for output on your website (e.g. as comment submission). You need to clean this HTML to avoid cross-site scripting (XSS) attacks.

Solution

Use the jsoup HTML Cleaner with a configuration specified by a Whitelist.

String unsafe = 
      "<p><a href='http://example.com/' onclick='stealCookies()'>Link</a></p>";
String safe = Jsoup.clean(unsafe, Whitelist.basic());
      // now: <p><a href="http://example.com/" rel="nofollow">Link</a></p>

So, all you basically need to do is the the following during processing the submitted text:

String text = request.getParameter("text");
String safe = Jsoup.clean(text, Whitelist.basic());
// Persist 'safe' in DB instead.

---

There is struts2securityaddons

This project contains additional configuration, interceptors, and other code used to improve the security of struts 2 applications.

See also

• XSS Prevention oin Java
• Prevent jsp from XSS
• struts2securityaddons

Answer 2

Escaping input parameters as an XSS prevention mean has several disadvanteges, especially:

• You can't be certain about destination of the particular input data, therefore you can't choose proper escaping scheme.
• Escaping input data masks lack of output escaping. Without consistent output escaping, you can still pass unescaped data to the unescaped output accidentially.
• Presence of escaping complicates data processing.

Therefor it would be better to apply consistent output escaping instead.

See also:

• OWASP XSS Prevention Cheat Sheet