ASithick143415 (Community Member) asked a question.
Struts 2 Property :Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
I am using a Struts 2 tag <s:property value="Form.Name" /> is showing an Veracode Flaw for Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
As per the Struts 2 Tag library
Used to get the property of a value, which will default to the top of the stack if none is specified.
- default (String) - The default value to be used if value attribute is null
- escapeCsv (Boolean) - Escape CSV. Defaults to false
- escapeHtml (Boolean) - Escape HTML. Defaults to true
- escapeJavaScript (Boolean) - Escape JavaScript. Defaults to false
- escapeXml (Boolean) - Escape XML. Defaults to false
- value (Object) - value to be displayed
escapeHtml is default set to true will escape the output html, is this check not enough to avoid the XSS ?
.png){kind=logo}
Hi @ASithick143415 (Community Member) ,
Struts2 tags apply HTML encoding by default and if this is not disabled this should be sufficient to prevent XSS.
This may be a false positive, however we will need more information to verify this.
Please Contact Support by:
Thank you,
Boy Baukema