xssvtl

Is there any specific function like htmlEscaper() for escaping VTL scripts in velocity template language?

I need to resolve Reflected XSS Cross site scripting vulnerability while using VTL script.

Solution

  • Using a text wrapper object.

    $textFromUser.Escaped
$textFromUser.EscapedMultiLine
$textFromUser.PlainText

    In this example, $textFromUser is defined in the context as a wrapper object with properties Escaped, EscapedMultiLine, and PlainText. The first property displays the text with the HTML codes escaped. The second also encodes carriage returns. The final property returns the text exactly as entered. If none of the three properties are given, the default text displayed should be Escaped.