java - Struts 2 encode input parameters to avoid XSS -

i have application built struts 2. has issues cross-site scripting (xss) attacks. want encode of actions input parameters in similar fashion jsp <c:out value="${somevalue}"/> there easy approach in struts 2? java api method fine.

edit found 1 - http://www.owasp.org/index.php/talk:how_to_perform_html_entity_encoding_in_java

any experience it?

you can use

<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn" %>  ${fn:escapexml(somevalue)} 

---

there api jsoup

sanitize untrusted html

problem

you want allow untrusted users supply html output on website (e.g. comment submission). need clean html avoid cross-site scripting (xss) attacks.

solution

use jsoup html cleaner configuration specified whitelist.

string unsafe =        "<p><a href='http://example.com/' onclick='stealcookies()'>link</a></p>"; string safe = jsoup.clean(unsafe, whitelist.basic());       // now: <p><a href="http://example.com/" rel="nofollow">link</a></p> 

so, need the following during processing submitted text:

string text = request.getparameter("text"); string safe = jsoup.clean(text, whitelist.basic()); // persist 'safe' in db instead. 

---

there struts2securityaddons

this project contains additional configuration, interceptors, , other code used improve security of struts 2 applications.

see also

• xss prevention oin java
• prevent jsp xss
• struts2securityaddons