• Page number: None
• Listing: None

Fortify mentioned this book during RSA as teaching insecure practices through examples that prove vulnerable to exploitation. We decided to start with this book and found several examples of vulnerable code samples. Most were HTML context XSS vulns, but one was used in the JavaScript context in JSON messaging.

"Since the code samples (in the book) are likely to be regarded as a best-practices guide, many software developers worldwide will learn insecure coding habits," Chess said.

Ryan Asleson, one of the authors of "Foundations of Ajax," said he had not heard of the alleged flaws in the sample code. However, he said, if those problems do exist, it is possible, because the code was kept as simple for a large audience. "We never intended the code that's in there to actually be production-ready code," he noted.

http://www.zdnetasia.com/news/internet/0,39044246,39378888,00.htm

• Page number: 60
• Listing: 3-8

This is the first example of code that is vulnerable to XSS:

//Get the user's input
String firstName = request.getParameter("firstName");
String middleName = request.getParameter("middleName");
String birthday = request.getParameter("birthday");

//Create the response text
String responseText = "Hello "+firstName +" "+ middleName
+". Your birthday is " + birthday + "."
+"[Method:"+method+"]";

//Write the response back to the browser
PrintWriter out = response.getWriter();
out.println(responseText);

• Page number:
• Listing:

This simple exploit will demonstrate the vulnerability:
<script>alert(‘XSS’);</script>

• Page number:
• Listing:

This code uses OWASP's ESAPI to encode the user's input in the proper context:

//Get the user's input
String firstName = request.getParameter("firstName");
String middleName = request.getParameter("middleName");
String birthday = request.getParameter("birthday");

//Create the response text
String responseText = "Hello "+ ESAPI.encoder().encodeForHTML(firstName) +" "+ ESAPI.encoder().encodeForHTML(middleName)
+". Your birthday is " + ESAPI.encoder().encodeForHTML(birthday) + "."
+"[Method:"+method+"]";

• Page number: 25
• Listing:

1234