Improper Neutralization of Input During Web Page Generation
ID |
scala.xss.scala_xss_rule_xssreqparamtoservletwriter |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Xss |
Language |
Scala |
Rationale
Servlet reflected cross site scripting vulnerability
The following code illustrates a vulnerable pattern detected by this rule:
class GreetingServlet extends HttpServlet {
@throws[ServletException]
@throws[IOException]
protected def straightToTheWriter(request: HttpServletRequest, response: HttpServletResponse): Unit = {
val nickname = request.getParameter("nickname")
// VULNERABLE: Improper Neutralization of Input During Web Page Generation
response.getWriter.write(nickname)
}
@throws[ServletException]
@throws[IOException]
@throws[ServletException]
@throws[IOException]
@throws[ServletException]
@throws[IOException]
protected def encodedForHtml(request: HttpServletRequest, response: HttpServletResponse): Unit = {
val nickname = request.getParameter("nickname")
val writer = response.getWriter
writer.write(Encode.forHtml(nickname))
}
@throws[ServletException]
@throws[IOException]
protected def encodedForHtmlAgain(request: HttpServletRequest, response: HttpServletResponse): Unit = {
val nickname = request.getParameter("nickname")
val writer = response.getWriter
writer.write(Encode.forHtml(nickname))
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A05 : Injection.