473,671 Members | 2,484 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Avoid Cross Site Scripting

52 New Member
I am using Tomcat 6.2 Application Server. Applications designed in MVC2 Architecture (JSP,Servlet,DA O) are running on this server. Now on my feedback form someone posted like a script
<script>alert(' test')</script>.
Since 10 Applications are running on my Tomcat, I am expecting a solution related to patteren matching to avoid this at the web.xml level.
Please help me out to resolve this problem.

Thanks & Regards
Dec 17 '09 #1
1 2239
chaarmann
785 Recognized Expert Contributor
It's called "malicious code insertion" this "someone" was doing to detect dirty coding, and you are lucky that he was only testing instead of doing damage.
You should learn from it to validate ALL your input properly.

Especially if you write some text to a webpage, you should make sure that it is really only simple text and not some HTML.
That means, check for and replace:
- HTML-tags: replace all "<" and ">" in your output with "&lt" and "&gt"
- HTML character entity references or numeric character references: replace all "&" with "&amp;", so that for example "company C&A" is not displayed as "company C" or company A&LtO" is not displayed as "company A<O" and so on.

By the way, if you write the stuff to a database as SQL-statement, you should also replace single quotation marks, or Mr. "someone" will delete your whole database and steal all your passwords with a malicious SQL-code insertion ...
Dec 17 '09 #2

Sign in to post your reply or Sign up for a free account.

Similar topics

7
1955
by: Venkat | last post by:
Hi All, I would like to about Cross Site Scripting. I googled XSS and got the point what it is but didn't get how it is achieved. Can someone describe me with an example how an hacker does it. My intension is not to hack anything but i am preparing a presentation on this and would like to caution my team mates about the consequences of XSS and how to protect our web based applications from a possible attack.
7
5081
by: CJD | last post by:
Hello, I want to create a server-side object that tracks the clicks of a user while they do a task in a browser. The tasks would take place on external web sites. Since there does not seem to be an all incompassing solution to the javascript cross-domain scripting permission problem, I am wondering if anyone has any server-side ideas. The link below proposes to do this, but I can't figure out how. Looking at their code, they are...
7
3907
by: Scott M. | last post by:
How can I disable the cross-site scripting check for one particular page of a site?
0
1153
by: Earl Teigrob | last post by:
I want to allow users to input html (via a rich text box) or directly, into a form field, save it in a data store and then output that html to the browser, but not allow cross-site scripting. What is the minimum that I need to filter to prevent cross-site scripting? Can it check for any occurance of the "<script" tag and alter it so that no usable javascript can be inserting with the HTML? Thanks
2
3019
by: ra90812 | last post by:
Can someone tell me how to do cross-site scripting in AJAX. any help would be highly appreciated. Thanks, Rajesh
11
4268
by: taoberly | last post by:
A few months ago I posted a question about using a file on my hard drive to perform cross-frame scripting and pull data from a server on my company's intranet. I eventually got this working using an HTA file and Internet Explorer. Now I'm tackling a similar issue, but really need to keep the IE menus, navigation buttons, etc. this time around. Assuming a solution exists, I'm guessing it involves using the IE6 SP2 "Mark of the Web"...
4
2158
by: Jacob JKW | last post by:
Having read the CLJ FAQ and having done extensive Googling, I do understand that in in general cross-domain iframe scripting is not permitted. One issue I have not seen directly addressed, however, is scripting across different but still "friendly" domains. Essentially I'd like to send a signal from the child to the parent in any form at all. I would think that there might exist a way to set some variable or object property that could...
0
1231
by: KZSteele | last post by:
(repost/edit from html forum) hello - i am using VBA within a microsoft access project to automate internet explorer. what i am doing is reading data from various frames of my company's web site (non-intranet) and loading it into a table. however, this cross-frame scripting security with IE is getting in the way. i can't even use VB to navigate to frames located on a different domain. the website in question uses framesets, not iframes. ...
0
1269
by: KZSteele | last post by:
(repost/edit from html forum) hello - i am using VBA within a microsoft access project to automate internet explorer. what i am doing is reading data from various frames of my company's web site (non-intranet) and loading it into a table. however, this cross-frame scripting security with IE is getting in the way. i can't even use VB to navigate to frames located on a different domain. the website in question uses framesets, not iframes. ...
0
8483
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
8926
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
1
8603
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
7444
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
5703
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
4416
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
1
2818
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
2060
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
2
1815
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.