Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  stripXSS(value)
}

override def getHeader(name: String) = {
  val value = super.getHeader(name)
  stripXSS(value)
}

// VULNERABLE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
private def stripXSS(value: String) = {
  var innerValue = value
  if (innerValue != null) { // NOTE: It's highly recommended to use the ESAPI library and uncomment the following line to
    // avoid encoded attacks.
    // value = ESAPI.encoder().canonicalize(value);
    // Avoid null characters
    innerValue = innerValue.replaceAll("\u0000", "")
    // Remove all sections that match a pattern
    for (scriptPattern <- RequestWrapper.patterns) {
      innerValue = scriptPattern.matcher(innerValue).replaceAll("")
    }
  }