我们在我们的网站上发现了 XSS 问题。我现在的工作是检查所有源代码，找出可能发生这种情况的地方。
我将搜索限制为特定的 JSF 问题。但无论我想搜索什么，该解决方案都应该有效。
本质上我想要一个 JSF 文件列表。我需要获取具有此条件的列表：搜索具有 标记并在该标记中具有“escape”属性和“value”属性的所有 *.jsp 文件包含“{”
我在工作中还无法访问静态源代码分析器。
关于如何进行此类搜索的任何想法？
我的大多数此类搜索都涉及使用 TextPad 进行正则表达式搜索。但我希望关于如何解决这个问题可能有一些更好的想法。
We discovered an XSS issues on our site. My job is to now go through all the source code finding where it might else be occurring.
I am limiting my search to a specific JSF issue. But the solution should work regardless of what I want to search.
Essentially I want a list of JSF files. I need to get list that has this criteria: search all *.jsp files that have the <h:outputText tag and with in that tag, have the "escape" attribute and the "value" attribute containing "{"
I don't have access to a static source code analyzer at work yet.
Any ideas on how I could do such a search?
Most of my searches like this involve Regular Expression Searches with TextPad. But I am hoping there might be some better ideas out there on how to approach this problem.
发布评论
评论（1）
在
*.jsp中搜索escape="false"。这应该足够了。要修复 XSS 漏洞，您应该确保它不会输出用户控制的输入，然后删除escape="false"属性。如果此用户控制的输入旨在以 HTML 形式重新显示，那么您需要首先将其从 mailcious 标记中清理掉。另请参阅此答案。Search on
escape="false"in*.jsp. That should be sufficient. To fix XSS holes, you should then ensure that it does not output user-controlled input and then remove theescape="false"attribute. If this user-controlled input is intented to be redisplayed literally as HTML, then you'd like to sanitize it from mailcious tags first. See also this answer.