Directly writing user input (for example, an HTTP request parameter) to a web page, -without properly sanitizing the input first, allows for a cross-site scripting vulnerability.
+Directly writing user input (for example, an HTTP request parameter) to a web page, + without properly sanitizing the input first, allows for a cross-site scripting vulnerability.
-To guard against cross-site scripting, consider using contextual output encoding/escaping before -writing user input to the page, or one of the other solutions that are mentioned in the -reference.
+To guard against reflected cross-site scripting in your backend java service, consider using + an appropriate HTML escaping library for your framework to sanitize the special HTML + characters. +
- For Android applications where an untrusted input is reflected into the WebView component
+ via risky methods such as evaluateJavascript, loadData or
+ loadDataWithBaseURL that execute javascript, use the following best practices:
The following example shows the page parameter being written directly to the page,
-leaving the website vulnerable to cross-site scripting.
If the above solutions do not work for your use-case, please consult your security assurance + team.
-The following example shows the page parameter being written directly to the
+ page, leaving the website vulnerable to cross-site scripting.
Use an HTML encoding API such as org.apache.commons.text.StringEscapeUtils.escapeHtml4to
+ sanitize the untrusted page parameter before inserting it into the HTTP response.