Question

I have a form that people can add their stuff. However, in that form, if they enter JavaScript instead of only text, they can easily inject whatever they want to do. In order to prevent it, I can set escapeXml to true, but then normal HTML would be escaped as well.

<td><c:out value="${item.textValue}" escapeXml="true" /></td>

Is there any other way to prevent JavaScript injection rather than setting this to true?

Answer 1

You need to parse the HTML text on the server as XML, then throw out any tags and attributes that aren’t in a strict whitelist.
(And check the URLs in href and src attributes)