how to sanitize the return values of getCookies(), getRequestURL() in HttpServletRequest?

Question

In my Java EE project, I set a filter in web.xml file which will use the Class MyHttpServeltRequestWrapper (extends HttpServletRequestWrapper). I am overriding the methods getParameter/ getParametervalues method in it inorder to prevent any XSS attacks.

I'm performing HTML escaping on parameter values.

Can someone please tell if it is a good idea to redefine the methods like

getRequestURL(),
getRequestURI(),
getQueryString(),
getCookies() methods to put in XSS prevention logic.

Can I use URLEncoder on values returned by getRequestURL(), getRequestURI(), getQueryString()?

And what about the getCookies methods? In what way it makes my pages vulnerable to attacks if I leave my getcookies() method unsanitized?

score 0 · Answer 1 · edited May 23 '17 at 09:59

0

You're going the wrong path as to XSS prevention. XSS does not harm in server side code. It only harms in the generated HTML output. It will harm when you inline user-controlled input unescaped among the existing HTML source code so that it get interpreted by the browser as part of real HTML source code. You need to replace HTML special characters like <, >, etc by <, >, etc so that they get displayed as-is instead.

Do it in the view side (JSP) only. Just use JSTL <c:out> or fn:escapeXml() everywhere you're redisplaying user-controlled input. They will escape HTML special characters.

E.g.

<c:out value="${someBean.someUserControlledValue}" />
<c:out value="${cookie.cookiename}" />
<c:out value="${header.headername}" />
<c:out value="${param.paramname}" />
<input type="text" name="foo" value="${fn:escapeXml(param.foo)}" />

But in some of the Java classes used by the jsp pages, I need to use getQueryString() method, for which i cannot do escaping. What can I do for some cases like,.. out.println(""); do u think URLEncoder.encode(request.getQueryString(), "UTF-8") is a good idea? Will it work properly? Pls suggest me what I can do for getCookies() method if I am using it somewhere in my java code. – Sridhar Feb 15 '12 at 06:43
You'd need to write a helper method which escapes HTML special characters so that you dan do for example `out.println("");`. But, in the first place, this application is apparently very badly designed from the beginning on. Java code doesn't belong in JSP files and HTML code doesn't belong in Java classes. See also http://stackoverflow.com/questions/3177733/how-to-avoid-java-code-in-jsp-files to learn how to design it properly. – BalusC Feb 15 '12 at 12:08

how to sanitize the return values of getCookies(), getRequestURL() in HttpServletRequest?

1 Answers1

See also: