Please consider this sample action which checks user upload file and returns a json of errors if there are any thing wrong to user.
The text in the jsp:
Your file has this text which is not correct : I are a programmer
public class SampleAction{
private List<String> errorCodesForFileUpload = new ArrayList<String>();
@Action(value = "sample-upload",
results = { @Result(name = "success", type = "json" .... }
public String upload() {
// proccess user file and show incorrect lines to user
errorCodesForFileUpload.add("Your file has this text which is not correct:" + USER_TEXT_IN_THE_FILE );
}
}
In the jsp we parse and show the errorCodesForFileUpload . This has the XSS vulnerability (If the file has any javascript in it)
I can fix it by escaping user text, before adding it to errorCodesForFileUpload.
But there are many actions which has been developed like this.
Is there any better way to customize json result and escape every string, before write?
