如何修复Java中反映的XSS [英] how to fix XSS Reflected in java

问题描述

我从下面的第二行得到了显示 XSS 反射缺陷的强化报告.

I got fortify report which shows XSS Reflected defect from the below 2nd line.

String name = request.getParameter("name");

String name = request.getParameter("name");

response.getWriter().write("Name: " + name);

response.getWriter().write("Name: " + name);

给出的建议:显示给 Web 客户端的所有用户输入都应进行 HTML 编码和验证.这是 Java 代码，我不确定如何解决这个问题.

Recommendation given: All user input displayed to web clients should HTML encoded and validated. This is java code and I am not sure about how to fix this.

推荐答案

一个简单的方法，你只需使用 OWASP Enterprise Security API (Java 版) :

A simple way, you can just use the OWASP Enterprise Security API (Java Edition) :

 String safe = ESAPI.encoder().encodeForHTML( request.getParameter( "input" ) );

查看这些链接:

OWASP Enterprise Security API(Java 版)文档

OWASP Enterprise Security API(Java 版)代码示例

这篇关于如何修复Java中反映的XSS的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！