java.lang.security.audit.xss.jsp.use-jstl-escaping.use-jstl-escaping

profile photo of semgrepsemgrep
Author
5,555
Download Count*
LGPL Commons Clause
License

Detected an Expression Language segment in a tag that does not escape output. This is dangerous because if any data in this expression can be controlled externally, it is a cross-site scripting vulnerability. Instead, use the 'out' tag from the JSTL taglib to escape this expression. See https://www.tutorialspoint.com/jsp/jstl_core_out_tag.htm for more information.

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: use-jstl-escaping
    message: Detected an Expression Language segment in a tag that does not escape
      output. This is dangerous because if any data in this expression can be
      controlled externally, it is a cross-site scripting vulnerability.
      Instead, use the 'out' tag from the JSTL taglib to escape this expression.
      See https://www.tutorialspoint.com/jsp/jstl_core_out_tag.htm for more
      information.
    metadata:
      owasp:
        - A03:2021 - Injection
      cwe:
        - "CWE-116: Improper Encoding or Escaping of Output"
      references:
        - https://www.tutorialspoint.com/jsp/jstl_core_out_tag.htm
        - https://stackoverflow.com/a/4948856
        - https://stackoverflow.com/a/3180202
      category: security
      technology:
        - jsp
      subcategory:
        - audit
      likelihood: LOW
      impact: LOW
      confidence: LOW
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
      vulnerability_class:
        - Improper Encoding
    pattern-regex: <(?![A-Za-z0-9]+:out).*?\$\{.*?\}.*>
    paths:
      include:
        - "*.jsp"
    languages:
      - regex
    severity: WARNING

Examples

use-jstl-escaping.jsp

<!-- ruleid: use-jstl-escaping -->
<input value="${param.foo}" />
<!-- ok: use-jstl-escaping -->
<c:out value="${param.foo}" />

<div>
    <!-- this is the reason use-escapexml is the preferred rule. JSP allows dangling EL expressions -->
    ${param.foo}
</div>