flawopen.com/क्रॉस-साइट स्क्रिप्टिंग/Java

क्रॉस-साइट स्क्रिप्टिंग in Java

उच्च CWE-79 Draft — pending review

Language: English Português (Brasil) Español Français Deutsch Русский 简体中文日本語 हिन्दी 한국어 Bahasa Indonesia

सरल व्याख्या (ELI5)

Imagine a bulletin board where someone posts an instruction that forces the viewer's computer to secretly send their session cookie to an attacker.

output encoding: Converting special markup characters into safe entities so browsers display them as text rather than script.

क्या हो रहा है

XSS in Java web applications occurs when JSP, Thymeleaf, or FreeMarker templates render request parameters directly into response streams without encoding.

वास्तविक दुनिया का प्रभाव

In 2005, the Samy XSS worm infected over 1 million user profiles on MySpace in under 20 hours, forcing the platform offline.

Documented historical AppSec case study.

असुरक्षित बनाम सुरक्षित कोड

VULNERABLE



  Welcome, <%= request.getParameter("name") %>

FIXED



  Welcome,

समाधान कैसे काम करता है

JSTL and Thymeleaf th:text convert sensitive HTML characters (<, >, &, ") into inert HTML entities.

भाषा-विशिष्ट सावधानियां

Thymeleaf th:utext

th:utext explicitly disables escaping. Use th:text for untrusted data.

आम गलतफहमियां

"Spring Boot automatically prevents all XSS"

Spring handles URL and JSON encoding, but template rendering depends on proper tag usage.

प्रभावित होने की जांच कैसे करें

grep -rn "<%=.*getParameter" --include="*.jsp" . grep -rn "th:utext" --include="*.html" .

Scan JSP and template views using FindSecBugs (rule XSS_REQUEST_PARAMETER_TO_JSP_WRITER).

रोकथाम चेकलिस्ट

✓Use in JSP or th:text in Thymeleaf
✓Run FindSecBugs in CI to catch unescaped output

अक्सर पूछे जाने वाले प्रश्न

How should rich user HTML be handled in Java?

Use OWASP Java HTML Sanitizer to strip dangerous tags and attributes before rendering.

संदर्भ

इस भाषा में देखें: Java Python JavaScript Java Go PHP C# Rust

यह भी देखें: SQL Injection Command InjectionPath Traversal