database - Display BLOB object in Java web project avoiding persistent cross site scripting? -

-

how display data stored blob object in java web project , avoid persistent cross site scripting vulnerability?

the method respond() in viewdeliveredreportspage.java sends un-validated data web browser on line 2775, can result in browser executing malicious code.

2773 byte[] barray = new byte[bytelen]; 2774 barray = blob.getbytes(1,bytelen); 2775 httpresponse.getoutputstream().write(barray); 2776 } catch (sqlexception e) { 2777 logger.error("error onselectionchanged

before pass data displayed, need escape it. owasp esapi library seems choice. can find here: https://code.google.com/p/owasp-esapi-java/downloads/list

byte[] barray = new byte[bytelen]; barray = blob.getbytes(1,bytelen); //you'll have convert string first - not //familiar java, principal same. string output = esapi.encoder().encodeforhtml(barray); httpresponse.getoutputstream().write(output); } catch (sqlexception e) { logger.error("error onselectionchanged

it's worth reading cheat sheet: https://www.owasp.org/index.php/xss_%28cross_site_scripting%29_prevention_cheat_sheet


Comments

Post a Comment

Popular posts from this blog

java - Date formats difference between yyyy-MM-dd'T'HH:mm:ss and yyyy-MM-dd'T'HH:mm:ssXXX -

-
i trying parse date 2014-12-03t10:05:59.5646+08:00 using these 2 formats: yyyy-mm-dd't'hh:mm:ss yyyy-mm-dd't'hh:mm:ssxxx when parse using yyyy-mm-dd't'hh:mm:ss works fine, when parse yyyy-mm-dd't'hh:mm:ssxxx parseexception thrown. which correct format parse date , difference between these 2 formats? note : cannot use joda :( those valid formats: yyyy-mm-dd't'hh:mm:ss.sssz >>> e.g.: 2001-07-04t12:08:56.235-0700 yyyy-mm-dd't'hh:mm:ss.sssxxx >>> e.g.: 2001-07-04t12:08:56.235-07:00 edit: btw, "x" refer (iso 8601 time zone)
Read more

c# - Get rid of xmlns attribute when adding node to existing xml -

-
i have xml-file: <ns2:root xmlns:ns2="namespace"> <ns2:a> <ns2:b>some content</b> <ns2:c>some content</c> <ns2:d>some content</d> </a> </root> i need add new node in specific place, code is: var doc = xdocument.load(file); xnamespace ns2 = "namespace"; doc.element(ns2 + "root").element(ns2 + "a").element(ns2 + "c").addafterself( new xelement(ns2+"new", new xelement("new1", new xelement("new2","some content"), new xelement("new3", "some content")))); the output is: <ns2:root xmlns:ns2="namespace"> <ns2:a> <ns2:b>some content</b> <ns2:c>some content</c> <ns2:new> <new1 xmlns=""> <new2>some content</new2> ...
Read more