Make ${} operator XSS safe in Struts 2 (same as tapestry)

Question

As mentioned in http://www.disasterarea.co.uk/blog/xss-vulnerabilities-in-web-frameworks-2/

The ${} is not xss safe in struts 2 while it is safe in tapestry 5.

I am not a Tapestry guy, but I want to know if above is correct.

As far as I know the ${} is part of JSLT and it does not depend on any web frameworks. So if above sentence is correct and the ${} is XSS safe in tapestry, how can we make it safe in struts 2.

Updated:

To test it I run struts2-showcase app, opened modelDriven\modelDrivenResult.jsp and add below line:

Am I safe  ${name} 

Now when you run the show case and enter <script> alert('xxxx') </script> as gangester name you can see the alert!

Mineralize

Where did you find that The ${} is not xss safe in struts 2? – Mcquoid

I have tested it! Two pages and one model driven action. First page populates the action with model second page shows some model properties with ${}. It is strust 2.3.16.2 with struts 2 jquery plugin 3.7.0 on apache-tomcat-7.0.42. Should I configure something?! – Mineralize

Please see my update, you can test it in struts show case – Mineralize

Answer 1

1. Struts2 <s:property value="name" /> is automatically escaped by default;
2. JSTL <c:out value="${name}" /> is automatically escaped by default;
3. JSP EL ${name} is NOT escaped.

You can explicitly escape it with ${fn:escapeXml(name)} , or set the escape to be performed by default creating a custom ELResolver as described in this great article:

• ELResolver Escapes JSP EL Values To Prevent Cross-Site Scripting

Stereochrome

This is what I was looking for, escaping ALL ${}. Do you think there is a reason which this feature is not implemented in Struts 2 same as tapestry? – Mineralize

@AlirezaFattahi For the reason I gave you: Struts 2 uses JSP. JSP EL doesn't escape values rendered via ${}. Tapestry does not use JSP. – Shabuoth

Answer 2

Short answer: make it safe either on entry into the app, or on the way to the view layer.

Tapestry's ${} is safe because it's not using JSP/JSP EL. Not escaping stuff is one of the things you lose by using JSP EL's ${} over things like <c:out> and so on.

Shabuoth

+1 for describing why ${} is xss safe in tapestry! (Tapestry does not use JSP!) – Mineralize