XSS Summary

For Stripes: -

1. Stripes will HTML escape all input tag values. This behavior bypass PopulationStrategy.
2. LocalizableError *fieldValue* will be escaped.
3. SimpleError will *not* be escaped.
4. SimpleMessage and LocalizableMessage will *not* be escaped.

For JSTL: -
1. will escape by default
2. ${..} will *not* escape
3. ${fn:escapeXml(...)} will call escapeXml function to escape the content.

Therefore: -

1. Always use to render output; don't use ${}
2. If you must use ${somevalue}, use ${fn:escapeXml(somevalue)}
3. All args that contain user input String value passed to MessageDisplay or ValidationErrors must be SafeHtmlUtil.HTMLEntityEncode(arg[n]).



XSS Prevention

https://www.owasp.org/index.php/XSS_%28Cross_Site_Scripting%29_Prevention_Cheat_Sheet

LOAD JSP during startup.

You can load jsp during startup by create JSP servlet in web.xml

         HomeJsp
         /home.jsp
         1

 

Using JavaBean Classes in JSP

jsp:usebean id="b" class="herong.DemoBean"

jsp:setproperty name="b" property="author" value="Someone"
Line 11: author =
jsp:expression>b.getAuthor()jsp:expression




jsp:setproperty/jsp:usebean>

http://www.herongyang.com/jsp/usebean.html