Question

I know this was asked before, but I am trying to figure out how to prevent XSS attacks for my Spring MVC web application.

1) I added the following to my web.xml

<context-param>
    <param-name>defaultHtmlEscape</param-name>
    <param-value>true</param-value>
</context-param>    

2) Should I also be using Commons StringEscapeUtils.escapeHtml() for each property in the form command object before I save it in the database? Would I need to unescape at some point as well?

Thanks

Answer 1

For now, I decided to sanitize my data and remove any HTML tags to avoid JavaScript attacks.

I’m using Jsoup api to do that.

http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer