Collected research
Bypassing OWASP ESAPI XSS Protection inside Javascript
OWASP ESAPI's encodeForJavaScript() hex-escapes untrusted input, but document.write() and eval() decode those escapes back at execution time, so escaped data still fires XSS once it lands in an HTML-body or eval context. A JSP proof of concept shows one string safely contained in a variable and two others executing. The fix is context-appropriate encoding, not an ESAPI code change.
Record
- Published by
- securethoughts.com
- Topic
- XSS
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of securethoughts.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .