Getting an error in cross site scripting within jsp

Question

I am working on a project where am getting an error of Cross Site Scripting.. In a JSP file there is a code line below

var selSubArea = document.adminForm.subjAreaId.options[document.adminForm.subjAreaId.selectedIndex].text;

Anyone having idea how to resolve it. Any help will be appreciated. Thanks in Advance

I have already tried to use different Encoding techniques but not working... for eg. Encode.forHtml, Encode.forJavascript, COV Security, fn EscapeXML.....

var selRole = document.adminForm.appnRoleId.options[document.adminForm.appnRoleId.selectedIndex].text;
var selSubArea = document.adminForm.subjAreaId.options[document.adminForm.subjAreaId.selectedIndex].text;
var selRoleID = document.adminForm.appnRoleId.options[document.adminForm.appnRoleId.selectedIndex].value;
var selSubAreaID = document.adminForm.subjAreaId.options[document.adminForm.subjAreaId.selectedIndex].value;

I am getting this Cross Site scripting issue with only texts Inputs.. and these are actually Dropdowns..

Comet · Accepted Answer · 2019-04-30 03:59:49Z

0

My guess is your trying to stop someone entering data XSS into your drop down menu from your question.

Maybe have the selected Index's info hard coded on the server/application and just send the index.

var selSubArea = document.adminForm.subjAreaId.selectedIndex;

If the index doesn't match indexes on the server/application, just ignore it.

answered Apr 30, 2019 at 3:59

Comet

2982 silver badges10 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Pratik Patil CONT Over a year ago

Thanks for the suggestion..I'll try to use it.. 😊

Pratik Patil CONT Over a year ago

Can you take look at this [stackoverflow.com/q/55927975/11352304]

Pratik Patil CONT Over a year ago

Hi, i tried to use var selSubArea = document.adminForm.subjAreaId.selectedIndex; but its only giving ID...is there any other way to use both at same time "option" & "SelectedIndex"...

Comet Over a year ago

Your ID should match your option on your server. How have you got your server side set up. It Should take Selected index and match it with the option

Collectives™ on Stack Overflow

Getting an error in cross site scripting within jsp

1 Answer 1

4 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related