Java Web site security solutions (especially XSS)

Question

I am developing a web application and am facing some security issues.

In my application, users can send messages and see others (message board, for example, an application). I check all form fields that users can submit to my application.

There are some very simple fields, such as "nick name", which can be 6-10 alphabetic characters or the time the message was sent, which is sent to users as a string, and then (when users request messages, "younger" or "older" than date). I am analyzing this with SimpleDateFormat (I am developing in java, but my question is not only related to java).

The big problem is the message box. I cannot limit it to alphabetic characters only (upper or lower case), because I have to deal with some commonly used characters such as ",", /, {,}, etc. (Users will not be satisfied if the system doesn't allow them to use these things)

According to this http://ha.ckers.org/xss.html there are many ways to "hack" my site. But I wonder if I can do this to prevent this? Not all, because there is no 100% protection, but I would like the solution to be able to protect my site.

I use server-side servlets and client-side jQuery. My application is "full" AJAX, so users open 1 JSP, then all data is loaded and displayed jQuery using JSON. (yes, I know that these are not "non-javascript users", but this is 2010, right? :-)) I know that checking the front end is not enough. I would like to use verification on 3 layers: - 1. front end, javascript check the data, then send to the server - 2. server side, the same check if there is something that should not be (due to javascript on the side client), I am a BAN user 3. if there is something that I could not catch earlier, the handler processes and processes accordingly

Is there a solution out of the box, especially for Java? Or another solution that I can use?

Answer 1

To minimize XSS attacks, it is important to encrypt any field data before returning it to the page. Like change> to> and so on. This would never allow the execution of any malicious code when added to the page.

I think you are doing a lot of the right thing with a white list of the data you expect for different fields. Also, for fields that may allow other characters, which may be problematic coding, will fix the problem for you.

Also, since you use Ajax, it gives you some protection, since people cannot override the values ​​in URL parameters, etc.

Answer 2

Take a look at the AntiSamy library. It allows you to define a set of rules for your application, and then run your user input through AntiSamy to clear it according to your rules.

Answer 3

The easiest way is to simply replace the following <c & lt;
> with &
'from \'

This will solve the big database vulnerability.