Question

I need to fix a issue for xss vulnerability. the code segment is below.

StringBuffer xml = new StringBuffer();
                      xml.append("<?xml version=\"1.0\"?>");
                      xml.append("<parent>");
                      xml.append("<child>");

                            for(int cntr=0; cntr < dataList.size(); cntr++){

                            AAAAA obj = (AAAAA) dataList.get(cntr);
                            if(obj.getStatus().equals(Constants.ACTIVE)){

                                xml.append("<accountNumber>");
                                xml.append(obj.getAccountNumber());
                                xml.append("</accountNumber>");

                                xml.append("<partnerName>");
                                xml.append(obj.getPartnerName());
                                xml.append("</partnerName>");

                                xml.append("<accountType>");
                                xml.append(obj.getAccountType());
                                xml.append("</accountType>");

                                xml.append("<priority>");
                                xml.append(obj.getPriority());
                                xml.append("</priority>");
                              }
                            }

                      xml.append("</child>");
                      xml.append("</parent>");  


                  response.getWriter().write(xml.toString());
                  response.setContentType("text/xml");
                  response.setHeader("Cache-Control", "no-cache");

The issue is at the line having the syntax response.getWriter().write(xml.toString()); It says that it is vulnerable for xss attack. I have done sufficient home work and also installed ESAPI 2.0. but I donot know how to implement the solutions.
Please suggest a solution.

Answer 1

You should always escape any text and attribute nodes you insert into an XML document, so I would expect to see

xml.append("<accountType>");
xml.append(escape(obj.getAccountType()));
xml.append("</accountType>");

where escape() looks after characters that need special treatment, eg. “<“, “&”, “]]>”, and surrogate pairs.

Better still, don’t construct XML by string concatenation. Use a serialization library that allows you to write

out.startElement("accountType");
out.text(obj.getAccountType());
out.endElement();

(I use a Saxon serializer with the StAX XMLStreamWriter interface when I need to do this, but there are plenty of alternatives available.)