CODEWITHSUNDEEP
javajspjakarta-eexss
爱国者
爱国者

Reputation: 4348

Is is possible to make an XSS in this situation ？

I have a jsp file with the following code snippet:

<form action=<%= request.getContextPath() %>/query_flight? ...

When using codesecue to do static code check, I got an XSS attack warning: enter image description here

But I am confused because context.getContextPath is a Java EE standard API. Is it possible to do an XSS attack??

Any suggestion?

Upvotes: 0

Views: 690

Answers (1)

JB Nizet
JB Nizet

Reputation: 691973

The tool is wrong. That said, I would use the <c:url> JSTL tag to generate the URL. It would take care of the context path, and of URL rewriting if necessary to track sessions.

Upvotes: 2

Related Questions