Html escape in byte array - xss issue

Question

I have byte array with html and try to escape. I convert byte array to string and replace special characters. When I make replace, my html doesnt work properly. It looks like a string and no css.

How to make properly ?

  String x= IOUtils.toString(getPdf(), "UTF-8");
  String secureX = replaceXssCharacters(x);
  return ResponseEntity.ok().contentType(
            MediaType.TEXT_HTML).body(secureX);


private String replaceXssCharacters(String value) {
if (value != null) {
  return value
          .replace("&","&")
          .replace("<", "&#60;")
          .replace(">","&#62;")
          .replace("\"","&#34;")
          .replace("'","&#39;");
}
return null;

}

Answer 1

You should not treat a PDF file as text or a string. Doing so can corrupt the file. Treat it as a binary file. Also you should not return or process it as if it were an HTML. In Spring Boot the media type should be MediaType.APPLICATION_PDF_VALUE. Refer to this answer on the how to set the presentation in the browser.