How to prevent integer values in jsp from XSS

Question

I have a scenario where i have to encrypt or protect integer.

For Example

//scriplet code
    <% int userId = request.getParameter("sid"); 
    ...%>

<input type = hidden name = "userID" value = "<%= userId %>" />

Any idea how can i encrypt integer or can i raise false positive in above code.

Please help as i have stucked up very badly.

What is the fortify error you are getting? – xdhmoore May 07 '20 at 18:20 — xdhmoore, May 07 '20 at 18:20

score 1 · Answer 1 · answered May 07 '20 at 18:43

If this is just about XSS then you should get away with either one of these (but ideally both):

OUTPUT ENCODING:

JSP Standard Tag Library has some useful functions, see this answer: XSS prevention in JSP/Servlet web application

For plain Servlet code you could for example use this Open Source library for the output encoding:

INPUT VALIDATION:

For the input validation you should for example check:

1 Answers1