CWE 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

PKumar022351 (Community Member) asked a question.

Below is My Existing Code:

String strOut = "<td width=\"10%\" id=\"searchResultsHeaderTDProd\" bgcolor=\"" + bgColor + "\">" + ESAPI.encoder().encodeForHTML(policyNumber)+"";

strOut+=" "+ESAPI.encoder().encodeForHTML(policyStatus)+"</td>";

out.println(strOut); -- Here this line getting Improper Neutralization of Script-Related HTML Tags

I am using below code to Resolve :

out.println(ESAPI.encoder().canonicalize(strOut));

But after scan still report is showing CWE 80 flaws and its not gone. Please assist me to resolve this issue.

Topics

Articles

No articles found

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.

CWE 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)