Does OWASP Java Encoder Project escape all XSS?

StackOverflow https://stackoverflow.com/questions/21093003

  •  27-09-2022
  •  | 
  •  

Question

Does OWASP Java Encoder Project escape all XSS? by methods

Encode.forHtmlContent(value)
Encode.forJavaScript(value)
Encode.forXml(value)

or better to use other solutions?

What OWASP solution you are advise for Java app?

Was it helpful?

Solution

ESAPI is no longer a flagship project for OWASP. There has been no releases since 2013, which means the project is stale.

If all you need is output escaping, use the encoder project. That one is maintained.

No single solution can be guaranteed to sanitize all XSS. You have to allow that a clever attacker might be able to exploit a bug in the HTML sanitizer.

OTHER TIPS

Yes, I think if you are looking for encoding API to stop XSS then OWASP Java Encoder is best option. For context based encoding to stooping XSS, I would prefer java encoder over ESAPI

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top