Difference between revisions of "OWASP Java Encoder Project"

Contextual Output Encoding

<body><%= Encode.forHtml(UNTRUSTED) %></body>

<textarea name="text"><%= Encode.forHtmlContent(UNTRUSTED) %></textarea>

<input type="text" name="address" value="<%= Encode.forHtmlAttribute(UNTRUSTED) %>" />

<div style="width:<= Encode.forCssString(UNTRUSTED) %>">
<div style="background:<= Encode.forCssUrl(UNTRUSTED) %>">

 <script type="text/javascript">
 var msg = "<%= Encode.forJavaScriptBlock(UNTRUSTED) %>";
 alert(msg);
 </script>

 <button 
 onclick="alert('<%= Encode.forJavaScriptAttribute(UNTRUSTED) %>');">
 click me</button>

<a href="/search?value=<%= Encode.forUriComponent(UNTRUSTED) %>&order=1#top">

<a href="/page/<%= Encode.forUriComponent(UNTRUSTED) %>">

String url = validateURL(untrustedInput);

 <a href="<%= Encode.forHtmlAttribute(untrustedUrl) %>">
 <%= Encode.forHtmlContent(untrustedLinkName) %>
 </a>

<%@page contentType="text/html" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
   "http://www.w3.org/TR/html4/loose.dtd">
<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>
<html>
   <head>
       <title><e:forHtml value="${param.title}" /></title>
   </head>
   <body>
       <h1>${e:forHtml(param.data)}</h1>
   </body>
</html>

var javaScriptNumber = <%= javaNumber %>;

<% // option (1)
String javaNumber = (untrusted data);
Double actualNumber = Double.parseDouble(javaNumber); // don’t forget to catch NumberFormatException
%>
<script>
var jsNumber = <%= actualNumber %>;
</script>

<% // option (2)
String javaNumber = (untrusted data);
%>
<script>
var jsNumber = parseInt("<%=Encode.forJavaScript(javaNumber)%>");
</script>

<dependency>
   <groupId>org.owasp.encoder</groupId>
   <artifactId>encoder</artifactId>
   <version>1.2.2</version>
</dependency>

<dependency>
   <groupId>org.owasp.encoder</groupId>
   <artifactId>encoder-jsp</artifactId>
   <version>1.2.2</version>
</dependency>

<input value="this is the value">
<input value=`this is the value`>

<div id=a><input value="``onmouseover=alert(1)"></div> 
<div id=b></div>
<script>b.innerHTML=a.innerHTML</script>

<input value=``onmouseover=alert(1)>

<input value="" onmouseover="alert(1)">

<input value="``onmouseover=alert(1)">

<script>a.innerHTML=b.innerHTML.replace(/`/g, "`");</script>

<input value=&#96;&#96;onmouseover=alert(1)>

var user = "<%= Encode.forJavaScript(user) %>";
`Hello ${user}, here is your total: ${total}`

`Hello ${"<%= Encode.forJavaScript(user) $>"}, here is your total ${total}`

@@ Line 6: / Line 6: @@
 ==OWASP Java Encoder Project ==
 The OWASP Java Encoder is a Java 1.5+ simple-to-use drop-in high-performance encoder class with no dependencies and little baggage. This project will help Java web developers defend against Cross Site Scripting!
-Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts (primarily JavaScript) are injected into otherwise trusted web sites. You can read more about Cross Site Scripting here: [[Cross-site_Scripting_%28XSS%29]]. One of the primary defenses to stop Cross Site Scripting is a technique called <i>Contextual Output Encoding</i>. You can read more about Cross Site Scripting prevention here: [[XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet]].
+Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts (primarily JavaScript) are injected into otherwise trusted web sites. You can read more about Cross Site Scripting here: [[Cross-site_Scripting_%28XSS%29]]. One of the primary defenses to stop Cross Site Scripting is a technique called <i>Contextual Output Encoding</i>.  <b>WARNING</b>: Please note that XSS prevention requires other defensive strategies besides encoding! For more information, please read about Cross Site Scripting prevention here: [[XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet]].
+As of September 16, 2018 there are no security issues submitted against this project! [https://github.com/OWASP/owasp-java-encoder/issues https://github.com/OWASP/owasp-java-encoder/issues]. We actively track project issues and seek to remediate any issues that arise. The project owners feel this project is stable and ready for production use and are seeking project status promotion.
 ==Introduction==
@@ Line 16: / Line 18: @@
 ==Quick Overview==
-The OWASP Java Encoder library is intended for quick contextual encoding with very little overhead, either in performance or usage. To get started, simply add the encoder-1.2.jar, import org.owasp.encoder.Encode and start encoding.
+The OWASP Java Encoder library is intended for quick contextual encoding with very little overhead, either in performance or usage. To get started, simply add the encoder-1.2.2.jar, import org.owasp.encoder.Encode and start encoding.
-Please look at the [http://owasp-java-encoder.googlecode.com/svn/tags/1.1/core/apidocs/org/owasp/encoder/Encode.html javadoc for Encode] to see the variety of contexts for which you can encode. Tag libraries and JSP EL functions can be found in the encoder-jsp-1.2.jar.
+Please look at the [http://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder/1.2.2/encoder-1.2.2-javadoc.jar javadoc for Encode] to see the variety of contexts for which you can encode. Tag libraries and JSP EL functions can be found in the encoder-jsp-1.2.2.jar.
-If you want to try it out or see it in action, head over to "Can You XSS This? (.com)" and hit it with your best XSS attack vectors!
 Happy Encoding!
@@ Line 37: / Line 37: @@
 * Java 1.5+ standalone library
-== Code Repo ==
+== Important Links ==
-[https://github.com/OWASP/owasp-java-encoder/ Java Encoder at GitHub]
+[https://github.com/OWASP/owasp-java-encoder/ Java Encoder at GitHub]<br/>
+[https://github.com/owasp/owasp-java-encoder/issues Issue Tracker]
 == Mailing List ==
@@ Line 65: / Line 66: @@
 == Quick Download ==
-* [https://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder-jsp/1.2/encoder-jsp-1.2-javadoc.jar encoder-1.2.jar]
+* [https://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder/1.2.2/encoder-1.2.2.jar encoder-1.2.2.jar]
-* [https://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder-jsp/1.2/encoder-jsp-1.2-javadoc.jar encoder-jsp-1.2.jar]
+* [https://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder-jsp/1.2.2/encoder-jsp-1.2.2.jar encoder-jsp-1.2.2.jar]
 == News and Events ==
+* [14 September 2018] 1.2.2 Released!
+* [19 February 2017] 1.2.1 Released!
+* [11 June 2016] No reported issues and library use is strong!
+* [1 May 2015] Moved to GitHub
 * [12 Apr 2015] 1.2 Released!
 * [10 Apr 2015] GitHub move
@@ Line 138: / Line 143: @@
   <a href="/page/<%= <b>Encode.forUriComponent(UNTRUSTED)</b> %>">
-== Handling an Full Untrusted URL ==
+== Handling a Full Untrusted URL ==
-When handling a full url with the OWASP Java encoder, first verify the URL is a legal URL.
+When handling a full URL with the OWASP Java encoder, first verify the URL is a legal URL.
   String url = validateURL(untrustedInput);
@@ Line 165: / Line 170: @@
   </html>
-Other contexts can be found in the org.owasp.Encode class methods, including CSS strings, CSS urls, XML contexts, URIs and URI components.
+Other contexts can be found in the [https://owasp.github.io/owasp-java-encoder/encoder/apidocs/index.html?index-all.html org.owasp.Encode class methods], including XML contexts and more.
+= How To Handle Numbers =
+Numbers don’t need encoding since they cannot cause XSS. There are no numbers that will break out of a javascript context. <b>If (and only if) ‘javaNumber’ is a numeric type (primitive or box wrapper), just use:</b>
+ var javaScriptNumber = <%= javaNumber %>;
+This is true even for the special cases of java.lang.Double.POSITIVE_INFINITY, NEGATIVE_INFINITY, NaN, and java.lang.Float equivalents.
+On the other hand, if ‘javaNumber’ is some user provided data that is NOT a numeric type, then you should either (1) convert it to a number on the java side, or (2) encode it to a string and handle it on the javascript side. E.g.
+ <% // option (1)
+ String javaNumber = (untrusted data);
+ Double actualNumber = Double.parseDouble(javaNumber); // don’t forget to catch NumberFormatException
+ %>
+ <script>
+ var jsNumber = <%= actualNumber %>;
+ </script>
+<b>-- OR --</b>
+ <% // option (2)
+ String javaNumber = (untrusted data);
+ %>
+ <script>
+ var jsNumber = parseInt("<%=Encode.forJavaScript(javaNumber)%>");
+ </script>
 = Deploy the Java Encoder Project =
-The OWASP Java Encoder version 1.1.1 is now available in central!
+The OWASP Java Encoder version 1.2.2 is now available in central!
 [http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22org.owasp.encoder%22 OWASP Encoder at Maven Central].
 == Core ==
-Direct Download: [http://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder/1.1.1/encoder-1.1.1.jar encoder-1.1.1.jar]
+Direct Download: [http://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder/1.2.2/encoder-1.2.2.jar encoder-1.2.2.jar]
 === Maven ===
   <dependency>
      <groupId>org.owasp.encoder</groupId>
      <artifactId>encoder</artifactId>
-     <version>1.2</version>
+     <version>1.2.2</version>
   </dependency>
 == JSP Tag Library ==
-Direct Download: [https://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder-jsp/1.2/encoder-jsp-1.2-javadoc.jar encoder-jsp-1.2.jar]
+Direct Download: [https://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder-jsp/1.2.2/encoder-jsp-1.2.2.jar encoder-jsp-1.2.2.jar]
 === Maven ===
   <dependency>
      <groupId>org.owasp.encoder</groupId>
      <artifactId>encoder-jsp</artifactId>
-     <version>1.2</version>
+     <version>1.2.2</version>
   </dependency>
@@ Line 202: / Line 234: @@
 In Internet Explorer, the grave accent is usable as an HTML attribute quotation character, equivalent to single and double quotes.  Specifically, IE treats the following as equivalent:
- <body><b><%= Encode.forHtml(textValue) %>" /></b></body>
   <input value="this is the value">
@@ Line 214: / Line 244: @@
 The following HTML snippet, demonstrates the cross-site scripting vulnerability related to grave accents on unpatched Internet Explorer:
-  <div id=a><input value="``onmouseover=alert(1)"></div>
+  &#x3C;div id=a&#x3E;&#x3C;input value=&#x22;&#x60;&#x60;onmouseover=alert(1)&#x22;&#x3E;&#x3C;/div&#x3E;
-  <div id=b></div>
+  &#x3C;div id=b&#x3E;&#x3C;/div&#x3E;
-  <script>b.innerHTML=a.innerHTML</script>
+  &#x3C;script&#x3E;b.innerHTML=a.innerHTML&#x3C;/script&#x3E;
 When this snippet is run in Internet Explorer the following steps happen:
@@ Line 260: / Line 290: @@
 The OWASP Java Encoder Library at its core is intended to be a XSS safe _encoding_ library.  The grave accent is a legitimate and frequently used character, that cannot be encoded to avoid this bug in unpatched versions of IE.  With enough user feedback, we may update the library to include one of the following options: (1) alternate, drop-in build that filters grave accents, with unchanged API, (2) new filtering methods.
+= Encoding and Template Literals =
+Several users of the Java Encoder have asked how to properly use the OWASP Java Encoder in combination with template literals.
+The best way to encode template literal variables is to first escape the untrusted data in a JavaScript variable and then place that variable in the template literal.
+ var user = &quot;&lt;%= Encode.forJavaScript(user) %&gt;&quot;;
+ `Hello ${user}, here is your total: ${total}`
+Another method is to properly escape the variable in-line.
+ `Hello ${&quot;&lt;%= Encode.forJavaScript(user) $&gt;&quot;}, here is your total ${total}`
 = Roadmap =
-== 2015 Roadmap ==
+== 2017-2018 Roadmap ==
+* Add decoders and canonicalization
+* Write a users guide including more complex examples
+* Build a mature test site
+* Optimize encoding to use new Java 8+ performance String utilities
-* [June 2015] New release with thread issue fix
-* [June 2015] Move to GitHub
-* [July 2015] Documentation cleanup release
-* [Sept 2015] Add decoders and canonicalization
 __NOTOC__ <headertabs />

Difference between revisions of "OWASP Java Encoder Project"

Latest revision as of 14:29, 16 September 2018

OWASP Java Encoder Project

Introduction

Quick Overview

Licensing

What is this?

Important Links

Mailing List

Project Leaders

Related Projects

Quick Download

News and Events

In Print

Classifications

Navigation menu

Search