How to configure Spring controller and / or JAXB to help prevent SQL / XSS injection

Question

I have a controller in Spring with the following method

@RequestMapping(value = "/v1/something", method = RequestMethod.POST, headers = "content-type=application/xml") @Valid public void something(@RequestBody final SomeBody myDto . . . . . 

I want to make sure the request body does not contain any SQL or Javascript characters to avoid SQL injections, XSS attacks, etc.

Is JAXB already handling this script? I was thinking of writing a filter, but can I only read the request body once?

Any suggestions?

Answer 1

Proper protection of XSS and SQL injection (and generally data validation) can occur only on the server side. Client-side validation does not matter, as a malicious user can simply write their own client or send their own HTTP request. Client-side validation is only useful for notifying inappropriate users about a form validation without feedback from the server (for example: make sure the field is a number or an email address). Even in this situation, the server must also perform a check.

To prevent the use of SQL injection, use bind variables (for example, prepared statements) for all parameterized queries. You will never have to concatenate client inputs to generate an SQL query. If you never generate SQL queries from client input and use them only as binding variables, you don’t have to worry about SQL injection at all.

 String clientValue = ... Connection conn = ... PreparedStatement stmt = conn.prepare("INSERT INTO foobar VALUES (?)"); stmt.setString(clientValue); stmt.executeUpdate(); 

Or using Spring JDBC:

 String clientValue = ... JdbcTemplate jdbcTemplate = ... jdbcTemplate.update("INSERT INTO foobar VALUES (?)", clientValue); 

To prevent XSS, make sure you deactivate all data before exiting. Whitelist client data when it is saved is also usually a good idea if you have an explicit subset of acceptable text, but it becomes more complex when you consider Unicode support. It is generally much easier to handle this on the rendering side.

For example, if you use JSTL to output your output, you should use something like:

 <%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions"%> ${fn:escapeXml(myModelVariable)} 

Answer 2

You can use Filters to clean forms. It will receive all your request attributes and clear them all. Another option is to use the JSoup API. Visit the following links to learn more.

JSoup XSS Api

Filtering approach to prevent XSS threats

EDIT:

Read OWASP Sheets to Know How to Avoid XSS and SQL Deployment.

OWASP - XSS Prevention

OWASP - SQL injection prevention

Take a look at the HDIV , which integrates with spring 3.1, it has built-in support for XSS, CSRF, data integrity checking.

Answer 3

For XSS attacks, mainly client-side hackers are used. For each user input, you can sanitize the input using encoding so that it extracts all special characters. The main client-side processing method is to use the javascript escape () function. OWASP is a good referee to get through the list of clients on the client side. For server-side hacking to prevent SQL injection, you can look at how to use prepared statements or use query-based querying (QueryDSL) or HQL, etc.