submitting form still risks from XSS

Question

I am assigned to fix security issues on legacy code and I was given results from security scan:

Poor Error Handling: Server Error Message ( 10932 )

Basically, when the scan tries to access with some weird code:

www.mywebsite.com/myapp/jspPage.jsp?myVar=Approved%26rhppvar%3DRHPP1234

The server returns 500 error code, but I have page that displays "An error occurred" to end users.

myVar should really only ever be "Approved" or "Rejected"

**jspPage.jsp**

String myVar= request.getParameter("myVar");
if(myVar== null)
    myVar= "";

 <form method="post" name="ics" action="jspPage.jsp?myVar=Approved">

I was wondering if I should be doing anything else as far as checking what gets passed to myVar parameter? I am not sure what the scan wants me to do...

Also, could the above form still be submitted with something other than Approved value?

Is this ok as far as not giving much information to attacker?

it depends on the error code. if the error shows a stack trace or other source-code, it's bad. — dandavis, Mar 09 '15 at 16:21
@dandavis no it doesn't. no stack trace. just plain "An error occurred". — Angelina, Mar 09 '15 at 16:23

score 2 · Accepted Answer · edited May 23 '17 at 12:31

As @dandavis comments, if the value of the myVar query string parameter is not output to the page then no XSS can occur.

Read the OWASP page on Cross-site Scripting (XSS) for more information, but basically a page is vulnerable to XSS if it is not correctly encoding output from untrusted sources.

e.g. if the page output the value of myVar and myVar was <script>alert(1)</script> and this caused a popup dialog box to be displayed, then it would be vulnerable.

submitting form still risks from XSS

1 Answers1