OWASP Java Encoder

To prevent Cross-Site Scripting (XSS) in JSP applications, you can use the encoder-jsp library. This library provides a Tag Library Descriptor (TLD) that includes custom tags and JSP Expression Language (EL) functions for contextual encoding.

1. Add the dependency

Include the encoder-jsp artifact in your project's dependency management system (e.g., Maven):

<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder-jsp</artifactId>
    <version>1.2.3</version>
</dependency>

2. Configure the JSP page

At the top of your JSP file, declare the tag library using the following URI:

<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>

3. Encode data

You can encode dynamic data using either JSP EL functions or custom tags:

• Via EL functions: Use the syntax ${e:functionName(value)}.
• Via tags: Use the syntax <e:functionName value="..." />.

Example usage for HTML encoding:

<p>Dynamic data via EL: ${e:forHtml(param.value)}</p>
<p>Dynamic data via tag: <e:forHtml value="${param.value}" /></p>

If you are using JSP, you should use the specific integration module corresponding to your Servlet specification to access JSP tags and EL functions.

For Servlet Spec 5 (using jakarta.servlet package):

<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder-jakarta-jsp</artifactId>
    <version>1.4.0</version>
</dependency>

For Legacy Servlet Spec (using javax.servlet package):

<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder-jsp</artifactId>
    <version>1.4.0</version>
</dependency>

<!-- using Servlet Spec 5 in the jakarta.servlet package use: -->
<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder-jakarta-jsp</artifactId>
    <version>1.4.0</version>
</dependency>

<!-- using the Legacy Servlet Spec in the javax.servlet package use: -->
<dependency>
    <groupId>org.owasp.encoder</groupId>
    <artifactId>encoder-jsp</artifactId>
    <version>1.4.0</version>
</dependency>

The JavaScriptEncoder supports four distinct modes of operation depending on where the encoded string will be placed in your web application. Choosing the correct mode is critical for preventing Cross-Site Scripting (XSS) attacks in specific contexts.

• SOURCE: Standard encoding for JavaScript strings. Uses the shortest possible escape sequences.
• ATTRIBUTE: For use within HTML attributes (e.g., onclick='...'). It uses hex encoding (\x22, \x27) for quotes instead of backslashes to ensure compatibility with XML-based attributes.
• BLOCK: For use inside HTML <script> blocks. It specifically escapes / as \/ and - as \- to prevent premature termination of the script block (e.g., by </script> or <!--).
• HTML: A hybrid mode for use in either HTML script attributes or blocks. It combines special escapes from both ATTRIBUTE and BLOCK modes.

/**
 * Mode of operation constants for the JavaScriptEncoder.
 */
enum Mode {
    SOURCE,
    ATTRIBUTE,
    BLOCK,
    HTML
}

The XMLEncoder class provides different encoding strategies depending on whether you are encoding XML content or attribute values, and which XML version you are targeting.

XML Versions

• XML_1_0: Control characters (except tab, LF, CR) are replaced with a space (U+0020).
• XML_1_1: Control characters (except tab, LF, CR) are encoded as character references (e.g., ).

Encoding Modes

Select a mode based on the context where the encoded string will be placed:

• ALL: Encodes &, <, >, ', and ". Safe for both content and attributes.
• CONTENT: Encodes &, <, and >. Use this for XML text nodes (CharData).
• ATTRIBUTE: Encodes &, <, ', and ". Use this for attribute values.
• SINGLE_QUOTED_ATTRIBUTE: Encodes & and <. Use this when the attribute is wrapped in single quotes (the ' itself is not encoded).
• DOUBLE_QUOTED_ATTRIBUTE: Encodes & and <. Use this when the attribute is wrapped in double quotes (the " itself is not encoded).

Note: In CONTENT mode, > is always encoded as > to avoid issues with ]]> sequences.

// Example: Creating an encoder for XML 1.1 attribute values wrapped in double quotes
XMLEncoder encoder = new XMLEncoder(XMLEncoder.Mode.DOUBLE_QUOTED_ATTRIBUTE, XMLEncoder.Version.XML_1_1);