Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
| Property | |
|---|---|
| Language | java |
| Severity |  |
| CWE | CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
| OWASP | A07:2017 - Cross-Site Scripting (XSS) |
| Confidence Level | Low |
| Impact Level | Medium |
| Likelihood Level | Low |
Description#
The custom XSSRequestWrapper implementation uses insecure filtering techniques to remove malicious input, but attackers can easily bypass these filters to inject harmful scripts. Relying on such manual filtering instead of robust, well-maintained libraries leaves your application vulnerable to XSS attacks.
Impact#
If exploited, attackers could inject malicious scripts into web pages viewed by other users, leading to theft of sensitive data, session hijacking, or manipulation of user actions. This compromises user trust, can result in data breaches, and may expose your organization to regulatory or reputational harm.