Difference between revisions of "OWASP Java Encoder Project"

Contextual Output Encoding

<body><%= Encode.forHtml(UNTRUSTED) %></body>

<textarea name="text"><%= Encode.forHtmlContent(UNTRUSTED) %></textarea>

<input type="text" name="address" value="<%= Encode.forHtmlAttribute(UNTRUSTED) %>" />

<div style="width:<= Encode.forCssString(UNTRUSTED) %>">
<div style="background:<= Encode.forCssUrl(UNTRUSTED) %>">

 <script type="text/javascript">
 var msg = "<%= Encode.forJavaScriptBlock(UNTRUSTED) %>";
 alert(msg);
 </script>

 <button 
 onclick="alert('<%= Encode.forJavaScriptAttribute(UNTRUSTED) %>');">
 click me</button>

<a href="/search?value=<%= Encode.forUriComponent(UNTRUSTED) %>&order=1#top">

<a href="/page/<%= Encode.forUriComponent(UNTRUSTED) %>">

String url = validateURL(untrustedInput);

 <a href="<%= Encode.forHtmlAttribute(untrustedUrl) %>">
 <%= Encode.forHtmlContent(untrustedLinkName) %>
 </a>

<%@page contentType="text/html" pageEncoding="UTF-8"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
   "http://www.w3.org/TR/html4/loose.dtd">
<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>
<html>
   <head>
       <title><e:forHtml value="${param.title}" /></title>
   </head>
   <body>
       <h1>${e:forHtml(param.data)}</h1>
   </body>
</html>

<dependency>
   <groupId>org.owasp.encoder</groupId>
   <artifactId>encoder</artifactId>
   <version>1.2</version>
</dependency>

<dependency>
   <groupId>org.owasp.encoder</groupId>
   <artifactId>encoder-jsp</artifactId>
   <version>1.2</version>
</dependency>

<input value="this is the value">
<input value=`this is the value`>

<div id=a><input value="``onmouseover=alert(1)"></div> 
<div id=b></div>
<script>b.innerHTML=a.innerHTML</script>

<input value=``onmouseover=alert(1)>

<input value="" onmouseover="alert(1)">

<input value="``onmouseover=alert(1)">

<script>a.innerHTML=b.innerHTML.replace(/`/g, "`");</script>

<input value=&#96;&#96;onmouseover=alert(1)>

@@ Line 20: / Line 20: @@
 The OWASP Java Encoder library is intended for quick contextual encoding with very little overhead, either in performance or usage. To get started, simply add the encoder-1.2.1.jar, import org.owasp.encoder.Encode and start encoding.
-Please look at the [http://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder/1.2/encoder-1.2-javadoc.jar javadoc for Encode] to see the variety of contexts for which you can encode. Tag libraries and JSP EL functions can be found in the encoder-jsp-1.2.1.jar.
+Please look at the [http://search.maven.org/remotecontent?filepath=org/owasp/encoder/encoder/1.2.1/encoder-1.2.1-javadoc.jar javadoc for Encode] to see the variety of contexts for which you can encode. Tag libraries and JSP EL functions can be found in the encoder-jsp-1.2.1.jar.
 Happy Encoding!

Difference between revisions of "OWASP Java Encoder Project"

Revision as of 18:54, 19 February 2017

OWASP Java Encoder Project

Introduction

Quick Overview

Licensing

What is this?

Important Links

Mailing List

Project Leaders

Related Projects

Quick Download

News and Events

In Print

Classifications

Navigation menu

Search