OWASP Java Encoder Project

Contextual Output Encoding

<body><%= Encode.forHtml(UNTRUSTED) %></body>

<textarea name="text"><%= Encode.forHtmlContent(UNTRUSTED) %></textarea>

<input type="text" name="address" value="<%= Encode.forHtmlAttribute(UNTRUSTED) %>" />

<div style="width:<= Encode.forCssString(UNTRUSTED) %>">
<div style="background:<= Encode.forCssUrl(UNTRUSTED) %>">

 <script type="text/javascript">
 var msg = "<%= Encode.forJavaScriptBlock(UNTRUSTED) %>";
 alert(msg);
 </script>

 <button 
 onclick="alert('<%= Encode.forJavaScriptAttribute(UNTRUSTED) %>');">
 click me</button>

<a href="/search?value=<%= Encode.forUriComponent(UNTRUSTED) %>&order=1#top">

<a href="/page/<%= Encode.forUriComponent(UNTRUSTED) %>">

String url = validateURL(untrustedInput);

 <a href="<%= Encode.forHtmlAttribute(untrustedUrl) %>">
 <%= Encode.forHtmlContent(untrustedLinkName) %>
 </a>

<%@page contentType="text/html" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
   "http://www.w3.org/TR/html4/loose.dtd">
<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>
<html>
   <head>
       <title><e:forHtml value="${param.title}" /></title>
   </head>
   <body>
       <h1>${e:forHtml(param.data)}</h1>
   </body>
</html>

var javaScriptNumber = <%= javaNumber %>;

<% // option (1)
String javaNumber = (untrusted data);
Double actualNumber = Double.parseDouble(javaNumber); // don’t forget to catch NumberFormatException
%>
<script>
var jsNumber = <%= actualNumber %>;
</script>

<% // option (2)
String javaNumber = (untrusted data);
%>
<script>
var jsNumber = parseInt("<%=Encode.forJavaScript(javaNumber)%>");
</script>

<dependency>
   <groupId>org.owasp.encoder</groupId>
   <artifactId>encoder</artifactId>
   <version>1.2.2</version>
</dependency>

<dependency>
   <groupId>org.owasp.encoder</groupId>
   <artifactId>encoder-jsp</artifactId>
   <version>1.2.2</version>
</dependency>

<input value="this is the value">
<input value=`this is the value`>

<div id=a><input value="``onmouseover=alert(1)"></div> 
<div id=b></div>
<script>b.innerHTML=a.innerHTML</script>

<input value=``onmouseover=alert(1)>

<input value="" onmouseover="alert(1)">

<input value="``onmouseover=alert(1)">

<script>a.innerHTML=b.innerHTML.replace(/`/g, "`");</script>

<input value=&#96;&#96;onmouseover=alert(1)>

var user = "<%= Encode.forJavaScript(user) %>";
`Hello ${user}, here is your total: ${total}`

`Hello ${"<%= Encode.forJavaScript(user) $>"}, here is your total ${total}`

OWASP Java Encoder Project

OWASP Java Encoder Project

Introduction

Quick Overview

Licensing

What is this?

Important Links

Mailing List

Project Leaders

Related Projects

Quick Download

News and Events

In Print

Classifications

Navigation menu

Search