312-96: Certified Application Security Engineer (Java)

By ECCouncil · Question Mode

QuestionQ10

VerifiedSecure Coding Practices for Input Validation

Stephen is a web developer at InterCall Systems. He was working on a Real Estate website for one of his clients and was assigned to design a web page with a property-search feature. He created the following searchpage.jsp:

< form Id="form1" method="post" action="SearchProperty.jsp" >  
< input type="text" id=''txt_Search" name="txt_Search" placeholder="Search Property..." / >  
< input type="Submit" Id="Btn_Search" value="Search" / >  
< /form >

However, when the application entered the security-testing phase, the security tester identified an XSS vulnerability on this page. How can he mitigate the XSS vulnerability on this page?

Explanation

Untrusted search input that is rendered in HTML must be encoded for the HTML output context. ESAPI.encoder().encodeForHTML(search) escapes characters such as <, >, and quotes, preventing a supplied script or HTML payload from being interpreted as active browser content. Directly writing a request parameter to the response leaves reflected XSS possible.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!