Rule Definition
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user within the output it generates without validating or encoding it.
An attacker can use XSS to send a malicious script to an unsuspecting user. The end user’s browser has no way to know that the script should not be trusted, and will execute the script. Because it thinks the script came from a trusted source, the malicious script can access any cookies, session tokens, or other sensitive information retained by the browser and used with that site. These scripts can even rewrite the content of the HTML page.
Remediation
Below are mandatory tag attributes.
Struts 1 : filter="true"
Struts 2 : escapeHtml='true'
Violation Code Sample
Sample for Struts 1
<%@taglib uri="/WEB-INF/struts-bean.tld" prefix="bean" %>
<%@taglib uri="/WEB-INF/struts-logic.tld" prefix="logic" %>
<html>
...
<body>
<b>Feedback Successfully Submitted.</b><br>
You have submitted the following feedback.
<table>
<tr>
<td>
Name :
</td>
<td>
<bean:write name="feedbackForm" property="name" /> // Violation
</td>
</tr>
...
__________________________________________
Sample for Struts 2
<%@ taglib prefix="s" uri="/struts-tags" %>
<html>
<head>
</head>
<body>
<h1>Struts 2 property tag example</h1>
<h2>1. Call getName() from propertyTagAction.java</h2>
<s:property value="name" />
<h2>2. Call getName() from Person.java</h2>
<s:property value="#personBean.name escapeHtml='false'" /> // violation
</body>
</html>
Fixed Code Sample
Remediation Sample for Struts 1
<%@taglib uri="/WEB-INF/struts-bean.tld" prefix="bean" %>
<%@taglib uri="/WEB-INF/struts-logic.tld" prefix="logic" %>
<html>
...
<body>
<b>Feedback Successfully Submitted.</b><br>
You have submitted the following feedback.
<table>
<tr>
<td>
Name :
</td>
<td>
<bean:write name="feedbackForm" property="name" filter="true"/> // FIXED
</td>
</tr>
...
__________________________________________
Remediation Samplefor Struts 2
<%@ taglib prefix="s" uri="/struts-tags" %>
<html>
<head>
</head>
<body>
<h1>Struts 2 property tag example</h1>
<h2>1. Call getName() from propertyTagAction.java</h2>
<s:property value="name" />
<h2>2. Call getName() from Person.java</h2>
<s:property value="#personBean.name escapeHtml='true'" /> // FIXED "<s:property value="#personBean.name " />" this is also a safe code as the escape HTLM is activated by default
</body>
</html>
Reference
https://www.owasp.org/index.php/Top_10-2017_A7-Cross-Site_Scripting_(XSS)
Related Technologies
Technical Criterion
Secure Coding - Input Validation
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.