Contents
V5330. OWASP. Possible XSS injection. Potentially tainted data might be used to execute a malicious script.
The analyzer has detected that data received from an external source could be used to execute a malicious script, exposing the application to XSS injection.
This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:
XSS (Cross-Site Scripting) is a vulnerability that allows attackers to inject malicious JavaScript code into web pages viewed by other users. As a result, attackers can steal user data, conduct a phishing attack, or perform other malicious actions.
URLs, HTTP request bodies, and HTML input fields are common targets for XSS attacks.
An example of code vulnerable to the XSS injection could be the following request handling in Servlet:
protected void doPost(HttpServletRequest req, HttpServletResponse res) {
String comment = req.getParameter("comment");
res.setContentType("text/html");
res.getWriter().write("<html><body>");
res.getWriter().write("<h3>User Comment:</h3>");
res.getWriter().write("<p>" + comment + "</p>");
res.getWriter().write("</body></html>");
}This method accepts a user comment and returns a response, which will then be displayed on the page. Since the message will be sent without pre-filtering, attackers can set the following values for the comment parameter:
<script>alert("XSS Injection")</script>Once the page is opened, the user's browser executes this malicious code, triggering a pop-up with the "XSS Injection" message. In the real case, attackers may use more complex and malicious scripts to steal cookies or perform other attacks.
To mitigate this vulnerability, escape the user's output using methods. In this case, use the escapeHtml method from the Apache Commons Lang library:
protected void doPost(HttpServletRequest req, HttpServletResponse res) {
String comment = req.getParameter("comment");
res.setContentType("text/html");
res.getWriter().write("<html><body>");
res.getWriter().write("<h3>User Comment:</h3>");
res.getWriter().write("<p>" +
StringEscapeUtils.escapeHtml4(comment)
+ "</p>");
res.getWriter().write("</body></html>");
}This diagnostic is classified as:
Was this page helpful?
