我如何使用Esapi按照veracode的建议对数据进行规范化。
out.print(ESAPI.encoder().encodeForHTML(jsonObj.toJSONString()));
现在在控制台中看到的数据是
{"total":1,"records":5,"rows":[{"id":"RLCP.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"534.7","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"2882","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE2882","ts":"RLCP.NS","clow":"437.5"}},{"id":"SBI.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"339.8","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"3045","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE3045","ts":"SBI.NS","clow":"278.1"}},{"id":"YESB.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"948.65","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"11915","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE11915","ts":"YESB.NS","clow":"776.25"}},{"id":"BOB.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"212.45","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"4668","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE4668","ts":"BOB.NS","clow":"173.85"}},{"id":"SBNK.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"128.85","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"7179","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE7179","ts":"SBNK.NS","clow":"105.45"}}]}
但它在html中呈现为
{"total":1,"records":5,"rows":[{"id":"RLCP.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"534.7","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"2882","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE2882","ts":"RLCP.NS","clow":"437.5"}},{"id":"SBI.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"339.8","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"3045","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE3045","ts":"SBI.NS","clow":"278.1"}},{"id":"YESB.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"948.65","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"11915","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE11915","ts":"YESB.NS","clow":"776.25"}},{"id":"BOB.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"212.45","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"4668","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE4668","ts":"BOB.NS","clow":"173.85"}},{"id":"SBNK.NS","cell":{"ser":"EQ","bdlt":1,"e":"NSE","chigh":"128.85","tick":"0.05","m":1,"prec":2,"W\/L":null,"exch":"nse_cm","tk":"7179","action":"<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>","rowtoken":"NSE7179","ts":"SBNK.NS","clow":"105.45"}}]}
如图所示,我的javscript无法理解数据并失败。我该怎么做才能解决这个问题。
答案 0 :(得分:1)
您需要根据打算使用数据的方式转换数据。在这种情况下,您拥有适用于javascript环境的数据,因此您希望ESAPI.encode().escapeForJavaScript()
使用指向界面的链接here.
如果您要将要直接呈现的数据发送到页面,那么您使用ESAPI.encode().encodeForHTML()
。
尽管如此,即使使用javascript转义也可能无法正常工作,因为您正在尝试对整个 JSON对象进行编码。为了使其正常工作,您需要确保为javscript上下文转义每个单独的数据元素。
例如,编组到此JSON的代码:
{
"id": "SBNK.NS",
"cell": {
"ser": "EQ",
"bdlt": 1,
"e": "NSE",
"chigh": "128.85",
"tick": "0.05",
"m": 1,
"prec": 2,
"W\/L": null,
"exch": "nse_cm",
"tk": "7179",
"action": "<button class='button-style-s button-alt2' onclick='Buy();'>Buy<\/button><button class='button-style-s button-alt1' onclick='Sell();'>Sell<\/button>",
"rowtoken": "NSE7179",
"ts": "SBNK.NS",
"clow": "105.45"
}
假设服务器上有java代码,您可能希望这样做:
public void someControllerMethod(httpReq, httpResp){
DataObject myData = somthingFromADao.getBean();
ViewBean vBean = new vBean();
vBean.setId(encoder.escapeForJavaScript(myData.id));
Cell myCell = myData.getCell();
Cell vCell = new vCell();
vCell.setSer(encode.escapeForJavaScript(myCell.getSer()));
// ...^^^can be done as a "populate" method or some similar pattern.
//Marshall as JSON
}
数据集中唯一可能让您感到头痛的事情似乎是&#34;行动&#34;字段:它显然试图注入要呈现的HTML。 Veracode不会标记它,但你必须确保你也在观察XSS的矢量。这应该重新设计,因此您不必将动态生成的代码作为数据元素传递。目前大多数XSS都是基于DOM的,因此您不希望在浏览器中编写HTML。
答案 1 :(得分:0)
我使用了ESAPI.encode()。escapeForJavaScript()我得到了以下结果
\x7B\x22mw0\x22\x3A\x22Default\x22\x7D
现在将其更改为我在代码后面使用的java脚本可以理解的格式。
data="\x7B\x22mw0\x22\x3A\x22Default\x22\x7D"
decodeURIComponent(data.replace(/\\x/g, '%'));
返回
"{"mw0":"Default"}"