0

Need to create xss check for whole response using servlet filter

public void doFilter(ServletRequest request, ServletResponse response,
                     FilterChain chain) throws IOException, ServletException
{
    chain.doFilter(request, response);
    // filter out xss here, and replace response
}

As I know after doFilter, response is already sent to client. Only chance to use wrapper.

Questions

  1. How to create wrapper?
  2. How to check whole html response for xss?
PashaDoro
  • 61
  • 10
  • 3
    This question is very wide, and if you need to ask it - frankly - you have no chance of implementing the filter yourself. And it starts with the fact that the attack does NOT come from the HTML response, but from the parameters (the request). If the attack is already performed and HTML is contaminated, there is not general way to filter the attack out. – fdreger Aug 02 '21 at 11:51
  • Have specific situation. XSS damaged data can be stored in DB from the different sources. And shown on display tru response. I need to implement exactly what is in question. Now checking for possibilities UPD. Already have XSS filter on for all incomming requests. Its not enough – PashaDoro Aug 02 '21 at 11:55
  • 1
    @PashaDoro There is no generic way to distinguish the JavaScript that is part of the page and JavaScript that is injected through XSS. If it is in the database, you should escape it wherever it is inserted into the page, so it is rendered as regular text. A filter is the wrong tool here. You can also look into [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP), but that's only an option if you have no other inline JavaScript. (And the XSS isn't injected into other files.) – Ivar Aug 02 '21 at 12:09
  • @PashaDoro what's "UDP"? What you describe in the question is, as others pointed out, impossible. Some partial solution, specific to your data, might be possible (still, servlet filter is simply the wrong level of abstraction to deal with it), but crafting the solution would require full knowledge of both the HTML already in DB and the HTML surrounding it. You will not find a reliable help on SO or any other forum, unless you are willing to share access to the DB and find someone willing to help you in their spare time. – fdreger Aug 04 '21 at 10:54

0 Answers0