How to fix cross-site scripting vulnerability in Java

Question

My Java-based web application has been flagged for XSS vulnerabilities. What are the best practices or libraries I can use to prevent XSS attacks, such as input sanitization, output encoding, or using secure frameworks?

Specific code examples or recommendations for popular libraries would be appreciated.

Answer 1

Fixing Cross-Site Scripting (XSS) Vulnerabilities in Java

When untrusted input is included in a web page's output without the appropriate validation or encoding, XSS vulnerabilities arise, giving attackers the ability to insert malicious scripts. Below are the steps and best practices to mitigate XSS vulnerabilities in Java-based applications.

1. Input Validation

Validate user inputs to ensure only expected data is accepted.

Example:

// Using a regex to allow only alphanumeric characters
String sanitizedInput = input.replaceAll("[^a-zA-Z0-9]", "");

Limitations: Input validation alone is not enough to prevent XSS, as valid input can still cause issues if not properly encoded before output.

2. Output Encoding

Encode data before rendering it in the browser to neutralize potentially malicious characters. Use libraries like OWASP Java Encoder for safe encoding.

Example with OWASP Java Encoder

Add the library to your project:

<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder</artifactId>
    <version>1.2.3</version> <!-- Use the latest version -->
</dependency>

Encode output:

import org.owasp.encoder.Encode;

// Encode for HTML
String safeOutput = Encode.forHtml(untrustedInput);

// Encode for JavaScript
String safeOutputForJs = Encode.forJavaScript(untrustedInput);

Why Encoding Helps:

Encoding ensures special characters (e.g., <, >, ") are converted into harmless equivalents (&lt;, &gt;, &quot;), preventing execution in the browser.

3. Use Secure Frameworks

Leverage modern frameworks with built-in XSS protection, such as:

• Spring Security: Includes XSS protection in templates and filters.
• Apache Shiro: Helps secure input handling and session management.

Example with Spring Security:

Spring automatically encodes output in JSP views. Ensure you're using the latest version and utilize features like @HtmlUtils for additional encoding.

<%= HtmlUtils.htmlEscape(untrustedInput) %>

4. Sanitize User Input

Sanitize inputs to remove malicious content using libraries like JSoup.

Example with JSoup

Add the library to your project:

<dependency>
    <groupId>org.jsoup</groupId>
    <artifactId>jsoup</artifactId>
    <version>1.16.1</version> <!-- Use the latest version -->
</dependency>

Sanitize input:

import org.jsoup.Jsoup;
import org.jsoup.safety.Safelist;

String cleanInput = Jsoup.clean(untrustedInput, Safelist.basic());

5. Content Security Policy (CSP)

Implement a Content Security Policy in HTTP headers to restrict where scripts can execute.

Add this header to your responses:

response.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self';");

Why CSP Helps: Even if XSS vulnerabilities exist, CSP limits the browser's ability to execute malicious scripts.

6. Use HTTP-Only Cookies

Prevent attackers from stealing session cookies by marking them as HTTP-Only:

Cookie sessionCookie = new Cookie("JSESSIONID", sessionId);
sessionCookie.setHttpOnly(true);
response.addCookie(sessionCookie)