Question

    String id = request.getParameter("id") != null ? request.getParameter("id") : "0";
            aaaa doc = bbb.getdetailsById(id);    
            byte b[] = doc.getUploaded();        
            try {
                response.setContentType("APPLICATION/OCTET-STREAM");
                String disHeader = "Attachment;Filename=" + doc.getName();
                response.setHeader("Content-Disposition", disHeader);
                servletoutputstream = response.getOutputStream();
                servletoutputstream.write(b, 0, b.length);
}

I have this piece of code. the code audit tool says that the servletoutputstream.write(b, 0, b.length); is xss vulnerable. but i dont have any clue how it is reporting the same. and how to fix it. i am using ESAPI to validate the input and to escape the output in other xss vulnerable reported issue. do i need to do the same to these also? please give suggestions or solutions.
after doing some research work i found that the byte b[] needs to be escape for the htmlESCAPE or xmlESCAPE by using ESAPI. will it solve the issue?

Answer 1

Validate the input ‘id’ using ESAPI for example.
Validate the fileName for FILE DOWNLOAD INJECTION using ESAPI. also validate the byte b[] using getVAlidatedFileContent() using ESapi.

This is a case of STORED XSS VULNERABILITY ISSUE.