How do I fix cwe-80 xss in jsp?

Question

<% 
String ans = ""; 
ans = SpecialCharacter.getEscapeString((String)request.getAttribute("ans"));
%>

<input type="text" class="txt long" name="ans" id="ans" maxlength="48" value="${ans}"/>

I have code like above, and I am using template literals already to substitute value but veracode scan still shows me that it is xss vulnerable. How do I fix in such case?

https://stackoverflow.com/questions/26646894/veracode-issue-in-jsp — Joop Eggen, May 15 '19 at 15:17
https://stackoverflow.com/questions/53612746/how-to-fix-veracode-cross-site-scripting-cwe-id-80-basic-xss-use-of-it — stamstam, Apr 09 '21 at 17:14

score 0 · Answer 1 · answered May 16 '19 at 12:32

0

Use OWASP Java Encoder use <input type="text" class="txt long" name="ans" id="ans" maxlength="48" value="<%= Encode.forHtmlAttribute(ans)%>" />

answered May 16 '19 at 12:32

SPoint

582
2
10

How do I fix cwe-80 xss in jsp?

1 Answers1