Web Hack List

Collected research

Bypassing OWASP ESAPI XSS Protection inside Javascript

OWASP ESAPI's encodeForJavaScript() hex-escapes untrusted input, but document.write() and eval() decode those escapes back at execution time, so escaped data still fires XSS once it lands in an HTML-body or eval context. A JSP proof of concept shows one string safely contained in a variable and two others executing. The fix is context-appropriate encoding, not an ESAPI code change.

Record

Published by
securethoughts.com
Topic
XSS

In the archive

Tags

This page is the archive's own catalogue record. The research is the work of securethoughts.com, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .