XSS Filter encoding and decoding

99 Views Asked by At

How can I handle situations where the encoded value from the XSS filter implemented with org.owasp.encoder.Encode.forHtml(UserInput), needs to be decoded for specific use cases such as populating HTML displays, displaying alert boxes, or filling text areas where single quotes and special characters.

How can I ensure that the encoded values from the XSS filter, which uses org.owasp.encoder.Encode.forHtml(UserInput), produce the expected output without encoding for various use cases across multiple screens, without having to manually include a decoding function on each page?

What will be the correct way?

I have tried with decoding functions for the particular variable value using in java class or scriptlet userinput= StringEscapeUtils.unescapeHtml4(unserinput);

and in Javascript

    let text = document.Form.textArea.value;
    let textarea = document.createElement('textarea');
    text = text.replace(/'/g, String.fromCharCode(39)); // single quote
    text = text.replace(/"/g, String.fromCharCode(34)); // double quote
        text = text.replace(/>/g, String.fromCharCode(62)); // greater than
        text = text.replace(/</g, String.fromCharCode(60)); // less than
        text = text.replace(/&/g, '&'); // less than
        textarea.innerHTML = text;
    document.Form.textArea.value=textarea.value;

But it is not possible to write at multiple pages or multiple places at frontend side since my application is vast and having more than 100 pages.

So what could be the possible ways?

0

There are 0 best solutions below