logo

Database

Java Vulnerable Spring Escape False

Description

This detector identifies Spring Framework configurations where HTML escaping is explicitly disabled, which can lead to Cross-Site Scripting (XSS) vulnerabilities. When HTML escaping is turned off, user-controlled data rendered in web pages will not be automatically sanitized, allowing malicious scripts to execute in users' browsers.

Weakness:

045 - HTML code injection

Category: Unexpected Injection

Detection Strategy

    • Scans Spring configuration files (typically XML) for <spring:htmlescape> tags

    • Flags configurations where the 'defaulthtmlescape' attribute is explicitly set to 'false'

    • Reports the exact line and column where the vulnerable configuration is found

    • Note that configurations with defaulthtmlescape='true' or missing defaulthtmlescape attribute (defaults to true) are considered safe

Vulnerable code example

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %>
<%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %>
<!DOCTYPE html>
<html>
<head>
    <title>User Profile</title>
</head>
<body>...

✅ Secure code example

<%@ page language="java" contentType="text/html; charset=UTF-8" pageEncoding="UTF-8" %>
<%@ taglib prefix="spring" uri="http://www.springframework.org/tags" %>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<!DOCTYPE html>
<html>
<head>
    <title>User Profile</title>
</head>...