Cross-site scripting (ARCH4101)

Ce contenu n’est pas encore disponible dans votre langue.

Key java.security.xss · Severity error · Category security · CWE CWE-79

Writing untrusted data to HTML output without escaping lets attackers run scripts in the victim’s browser (XSS), leading to session theft or page defacement.

Incorrect

String name = request.getParameter("name");
response.getWriter().write("<p>Hello " + name + "</p>");

Correct

String name = request.getParameter("name");
String safe = HtmlUtils.htmlEscape(name);
response.getWriter().write("<p>Hello " + safe + "</p>");

Fix

Context-escape all untrusted data before writing it into HTML, or use auto-escaping template engines.