Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

ID

scala.xss.scala_xss_rule_wicketxss

Severity

low

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Xss

Language

Scala

Description

Disabling HTML escaping put the application at risk for Cross-Site Scripting (XSS).

Rationale

Disabling HTML escaping put the application at risk for Cross-Site Scripting (XSS).

The following code illustrates a vulnerable pattern detected by this rule:

// Turning model-string escaping off makes the label render its value as markup.
class ProfilePage extends WebPage {
  def build(parameters: PageParameters): Unit = {
    // VULNERABLE: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    add(new Label("biography").setEscapeModelStrings(false))
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved