Subscribe to the RSS feed
XSS and Web Frameworks
Matt Raible recently blogged about Java Web Frameworks and XSS. The post and the comments are well worth reading. It’s easy to think (hope!) that a framework will automatically escape output to prevent XSS and give no more thought to it. As Matt’s post shows, you really need to know how your chosen framework deals with the issue.
If you use Struts 2 or WebWork be sure to read the post and update your libraries.