jsp - XSS with dynamic HTML input -

jsp - XSS with dynamic HTML input -

my team fixing vulnerability threats old jsp application. problem allows (permissioned) users create simple home page putting html textarea , having render on page. problem xss issues. have been doing research , found withing jsp pages can use:

fn:escapexml() jstl library escape html/xml inputted. fine simple form inputs, home page creator, want able maintain simple html rid of harmful scripts or xss vulnerabilities.

my teammate , new fixing xss issues , have been relying on resources find..

i have come across these resources , not sure if work way after reading through them.

-which html sanitization library use?

-https://www.owasp.org/index.php/xss_%28cross_site_scripting%29_prevention_cheat_sheet

if utilize owasp, sanitize html basic rendering , prevent scripting beingness implemented?

here have in jsp:

<td class='caption'> <c:set var="x"><%=system.getname()%></c:set> options ${fn:escapexml(x)} </td>

this works , stop html/xml/script running still basic html (titles, paragraphs, fonts, colors, etc) simple informational page html.

according owasp

if application handles markup -- untrusted input supposed contain html -- can hard validate. encoding difficult, since break tags supposed in input. therefore, need library can parse , clean html formatted text.

there different html sanitizing libraries. owasp-java-html-sanitizer library choice.

you can utilize prepackaged policies:

policyfactory policy = sanitizers.formatting.and(sanitizers.links); string safehtml = policy.sanitize(untrustedhtml);

configure own policy:

policyfactory policy = new htmlpolicybuilder() .allowelements("a") .allowurlprotocols("https") .allowattributes("href").onelements("a") .requirerelnofollowonlinks() .build(); string safehtml = policy.sanitize(untrustedhtml);

or write custom policies:

policyfactory policy = new htmlpolicybuilder() .allowelements("p") .allowelements( new elementpolicy() { public string apply(string elementname, list<string> attrs) { attrs.add("class"); attrs.add("header-" + elementname); homecoming "div"; } }, "h1", "h2", "h3", "h4", "h5", "h6")) .build(); string safehtml = policy.sanitize(untrustedhtml);

read documentation total details.

html jsp xss owasp