ASahu202858 (Community Member) asked a question.
How to fix Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE ID 80) in below line, after adding StringEscapeUtils :
StringEscapeUtils.unescapeHtml(Encode.forHtmlContent(requestString)).getBytes()
StringEscapeUtils.unescapeHtml(Encode.forHtmlContent(requestString)).getBytes()
Providing more code snippet for better understanding :
//import used
import org.apache.commons.lang.StringEscapeUtils;
import org.owasp.encoder.Encode;
DataOutputStream dtOpStrm = new DataOutputStream(XXXXXXXXXXXXXXXXXXXXX);
// getting Cross-Site Scripting (XSS) in below line
dtOpStrm.write(StringEscapeUtils.unescapeHtml(Encode.forHtmlContent(requestString)).getBytes());
After adding StringEscapeUtils.unescapeHtml(), we started getting this flaw.
We need this for converting "& to &" html chars.
Please suggest some solution.
I already tried few solutions from Veracode Community regarding this flaw.
Seems like we still facing this Vulnerability.
.png){kind=logo}
Hi @ASahu202858 (Community Member) ,
"StringEscapeUtils.unescapeHtml(Encode.forHtmlContent(" does not do anything. It's like tying your shoes and immediately untying them.
Typically, if adding HTML encoding is producing unwanted "&" characters it means that you are either:
If you have any other questions, I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema