Weblogic xss vulnerablity : html character entities getting decoded in jsp by ${} expression

This is from my question at stack overflow java - Weblogic xss vulnerablity : html character entities getting decoded in jsp - Stack Overflow
I am using a filter to prevent xss by encoding html character of my jsp form parameters.
I am resolving them in jsp using ${param} expression.
This is working fine in tomcat as the values are resolved as is, but on weblogic the values are getting decoded, causing the XSS to succeed
I am using this simple code in jsp to test it
<c:set var="testing" value="eb011"><img src=a onerror=confirm(1)>47379"/> <input type="hidden" name="encoding" value="${testing }"/>
Result in tomcat
<input type="hidden" onerror="confirm(1)>47379"/" src="a" ><img="" value="eb011" name="encoding">
Result in weblogic
<input type="hidden" value="eb011" name="encoding"><img onerror="confirm(1)" src="a">47379"/>
why is weblogic decoding html codes and what could be done to prevent it.

It is really handy to learn how to read schema validation errors. It really does say exactly what's wrong there. If you can get access to the XSD that your XML document is prescribing, you should be able to tell what mistake you made. If you learn how to do this, you'll never have to ask questions like this again. :)
The error refers to the "http://www.bea.com/ns/weblogic/weblogic-web-app" namespace, which I believe is in your "weblogic.xml" file. It's saying that in the "jsp-descriptor" element, it found a "noTryBlocks" element at a point where it was not legal. At that point, it expected to find either a "'precompile-continue" or several other elements, but not that one. Read the XSD to determine the correct order for elements. If you're editing this file in Eclipse, you may not even have to obtain the XSD. If you hover the mouse over the root element of the document, it will give you a popup showing the syntax details of the element, which will tell you what the expected order of elements is.

Similar Messages

Rendering text that contains old-style HTML character entities, e.g. ü

The large text-corpus I'm working with was produced before the days of widespread Unicode support, and it contains HTML character entities instead of unicode codepoints, e.g. ü for ü [u-umlaut].
I can iterate through every text column in the ArrayCollections that I'm using for dataProviders to the DataGrid, and replace these entities with their unicode counterparts before the provider is assigned to the grid. But is there already a mechanism in place in Flex to render character entities in the DataGrid? Is there a ready-made ItemRenderer that can do this?
Thanks

DrClap wrote:
So your example looks like this?
<someNode>der fuchs springt über den stein</someNode>
now I feel stupid :-) Yes, that's correct.
And you're actually getting an EntityReference node in your Document? I find that rather strange, since the documentation for EntityReference says
Note that character references and references to predefined entities are considered to be expanded by the HTML or XML processor so that characters are represented by their Unicode equivalent rather than by an entity reference.
Exactly!
Because what you have there is a character reference. Is there something else in the document, a DTD for example, which might be interfering with that?No, just an ordinary XML header:
<?xml version="1.0" encoding="UTF-8"?> ...If it helps, I can also post the complete document I am receiving.

Displaying HTML character entities in JEditorPane

Hi,
I have noticed that when displaying HTML character entity references in a JEditorPane it will show some of them, e.g. © for copyright symbol but not others e.g. ’ for "curly" single quote.
Is there any way to get JEditorPane to show all (most?) of them?

Create a class that extends ComboBox and override the
updateDisplayList and measureText functions. Then use that new
ComboBox in your code:
<local:HtmlComboBox .. xmlns:local="components.*".>
<local:itemRenderer>
<mx:Component>
<mx:Text htmlText="{data.label}" />
</mx:Component>
</local:itemRenderer>
</local:HtmlComboBox>
Put this into a folder called "components" and name the file
HtmlComboBox.as
package components
import mx.controls.ComboBox;
import flash.text.TextLineMetrics;
public class HtmlComboBox extends ComboBox
public function HtmlComboBox()
super();
override protected function
updateDisplayList(unscaledWidth:Number, unscaledHeight:Number):void
super.updateDisplayList(unscaledWidth,unscaledHeight);
var s:String = textInput.text;
textInput.htmlText = s;
override public function
measureText(text:String):TextLineMetrics
return measureHTMLText(text);
}

How do I display Tools Developer Page Source without HTML Character Entities, such as & and

I am using Firefox 8.0 on Windows XP. In earlier versions of Firefox, when I would display the page source, the page would be displayed in all its original characters, including < > & and so on (including the HTML reserved characters.)
Now when I display page source, the page source is displayed, but instead of displaying html tags,
<p> for example,
it will display <p> in the source instead.
For a longer example, instead of displaying
<p class="stuff">text to display</p>
the source is rendered as
<p class="stuff">text to display</p>
Is there a way to direct Firefox to display page source using all actual characters instead of using character entities?

Clarification.
The html tags render until it encounters this code:
<input id="htmlHidden" type="hidden" value="&lt;div id=&quot;content&quot;&gt;
&lt;div id=&quot;content-inside&quot;&gt;
&lt;div id=&quot;content-space&quot;&gt;
&lt;div id=&quot;about&quot; class=&quot;node&quot;&gt;
&lt;div class=&quot;node-inner&quot;&gt;...

Assign HTML character entities

Hello,
I have a scenario where a message should be sent to an HTTP server using the HTTP receiver CC. In the message itself no special HTML characters such as <, > or / should be used but they should be replaced with special character entities such as &lt for < .
Is there an easy way to do this as it is quite a common requirement? Is there an adapter module available for this or must this be done in the mapping itself?
Thank you for your advice.
Edited by: Florian Guppenberger on Aug 11, 2009 6:54 PM
Edited by: Florian Guppenberger on Aug 11, 2009 6:55 PM

> public void execute(InputStream in, OutputStream out)
>           throws StreamTransformationException {
> try{
> int c;
>     while ((c = in.read()) != -1) {
>       switch (c){
>          case '&': out.write("&amp ;".getBytes()); break;
>          case '<': out.write("&lt ;".getBytes()); break;
>          case '>': out.write("&gt ;".getBytes()); break;
>          default: out.write(c);
>        }
>
>     }
>   } catch (IOException e) {
>     throw new StreamTransformationException(e.getMessage());
>   }
>
>
> }
The SDN forum does not allow html escape sequences, so I put a space before the ; which you have to remove in your code.
' and " need not to be escaped, so I removed that lines.
Edited by: Stefan Grube on Aug 16, 2009 11:06 PM

HTML character entities problem in saved regex search and replace query

I have a many search and replace regular expression queries (.dwr files) that I have saved. I have a problem specifically with saved queries that contain HTML entities such as "& nbsp ; " or "& shy ;" (spaces added otherwise code doesn't render in browser). For example if I use the following search:
([\d]{3}& shy ;[\d]{3}& shy ;[\d]{4}|[\d]{3}& nbsp ;[\d]{3}& nbsp ;[\d]{4})
(which searches for numbers in the 888-555-1234 or 888 555 1234 formats)
This will work fine if I manually enter it into the search text area. However if I save it to file and reload it, it will no longer work because the  and characters are now displayed as " " (space) and "-"(shy) rendering the saved query useless as it's no longer searching for the code. I have some fairly long and complex queries and this is becoming a problem.
Thanks for any help.
I'm currently using Dreaweaver CS4 at home and CS5.5 at work.

Thanks for your reply Kenneth, but that is not what I'm trying to accomplish. I'm looking for the HTML entities that exist in the source code which are & shy ; and & nbsp ; (without the spaces). As I mentioned above, if I enter them manually in the search box, I will get the corrrect results. If I save the search and then reload it, the special characters are no longer in HTML and the search is now useless.
Just for example again
In an open document in code view insert a number in the format (without the spaces): 888& nbsp;888& nbsp ;8888
Open a search dialog box and enter (without the spaces): [\d]{3}& nbsp ;[\d]{3}& nbsp ;[\d]{4}
The search will find that entry.
Save search as phone.dwr for example. Then load it and try the search again. It won't work because upon loading the search Dreamweaver replaces the HTML code which was saved with the rendered HTML. So now the search shows up as: [\d]{3} [\d]{3} [\d]{4} which will not find the string with hard coded non-breaking spaces that I'm looking for.
Basically I want to be able to save a search query for reuse. When I load a search query, I want it to be exactly what I saved, not something that DW has rendered (that doesn't work).

Displaying Numeric Character Entities

I�m having a problem displaying numeric character entities such as �� (m-dash) in my Java application. I have noticed that some characters will show up correctly and some will not, for example �}� (Right curly brace) shows up just fine. I�m having the same problem with Japanese numeric character entities such as �式�. The encoding that is being used here is UTF-8.
I am reading the text that contains these entities from a XML file using the following code:
    DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
    dbf.setNamespaceAware(true);
    dbf.setIgnoringComments(true);
    dbf.setIgnoringElementContentWhitespace(true);
    try {
      FileInputStream fff = new FileInputStream(theFile);
      InputSource inSource = new InputSource(new InputStreamReader(fff,"UTF-8"));
      DocumentBuilder db = dbf.newDocumentBuilder();
      Document doc = db.parse(inSource);
    } catch (Exception e) {
      System.out.println("Exception: " + e);
    }Here is a simple example of an xml file.
<?xml version="1.0" encoding="UTF-8"?>
<toc name="Course One" file="course1/toc.xml">
<topic name="Topic � One" file="course1/source/topic1.html"/>
<topic name="式 (Japanese char)" file="course1/source/topic2.html"/>
</toc>When I print out the contents of the name attribute I get boxes (or a ?) in place of the character entity. Any help that can be offered here would be greatly appreciated.
Thanks,
David

I just realized that the entities that I put in my post were resolved by the browser, so they didn't show up as the actual numeric entity code as I intended,  (& + #151;) for m-dash } (& + #125;) for the curly brace and 式 (& + #24335;) for the Japanese character. The XML file looks like this:
<?xml version="1.0" encoding="UTF-8"?>
<toc name="Course One" file="course1/toc.xml">
<topic name="Topic  One" file="course1/source/topic1.html"/>
<topic name="式 (Japanese char)" file="course1/source/topic2.html"/>
</toc>

Character entity getting stripped by Dreamweaver

I'm using some Supplementary Private Use Area-A character entities to load some custom font icons, 󰀀, 󰀁, and 󰀂. For some reason, Dreamweaver keeps stripping out the 󰀀 entity when I save the document. The other two entities do not get stripped out. I only use the code editor, not the WSYIWYG and my character encoding is set to UTF-8: <meta content="text/html; charset=utf-8" http-equiv="Content-Type">. Am I doing something wrong or is there a setting I'm missing?

I can confirm this also happens in CS6 ver 12.2 #6006. I don't know why that particular entity code won't stick. You can file a bug report below:
https://www.adobe.com/cfusion/mmform/index.cfm?name=wishform
Nancy O.

HTML Character entity references on SQLQuery

I am trying retrieve the data thru XMLElement and I like to do a HTML Character entity references. I guess XMLElement does it with the proper character set translations and I was not successul in getting it correct. Could you please help me out. My DB character set it UTF-8.
For example, the "acute" e needs to be translated to its hexa equivalent. I tried it by setting the mid-tier's client's NLS but with no success. I dont want to scan the each character and convert it.
create table master.temp_xml_encode
(party_name_id NUMBER(15),
party_id NUMBER(15),
party_name VARCHAR2(200) );
PARTY_NAME_ID PARTY_ID PARTY_NAME
3831587 5496840 The West Company México, S.A. de C.V.
3844362 5496730 Schiønning & Arvé A/S
3847940 5496836 West Rubber de España, S.A.
4047634 5983166 Timberland España, S.L.
4266163 5983166 Timberland España, S.A.
4285954 6482794 The Young Women¿s Christian Association of Central New Jersey
SELECT XMLELEMENT("party_id", party_id,
xmlforest(party_name_id AS "partynameid",
party_name AS "partyname"
FROM master.temp_xml_encode
Thanks for your help

And Yes forgot to add one thing, the index.jsp is a part of the application supplied by vendor and I do not have src of the struts actions (no control on server side code).
I need to find a solution from client's side.

EJB3: When do Entities get detached in practice?

Hi,
I am currently improving my first EJB3 / JSF prototype in order to get a good feeling for that new technology. I am using Sun Appserver 9, NetBeans 5.5.
I have the followiong design-setup:
JSF-BackingBean ===uses===> @Remote Stateless Session Bean ===fetches==> EntityBeans
The general question is: 1.) Where do EntityBeans get detached in a JSF setup and 2.) does detaching mean, that I cannot traverse the relations anymore, even if I have eager fetching configured`?
Let me also ask some more detailed questions:
The Backing Bean stores the Entity Bean "A" in an attribute. So far so good. My Entity A has a 1:n association to Entity B with eager fetching configured in the annotation. When I now want to access the relation getBs() from within a JSF forEach statement, I keep getting an error from the persistence layer.
I found out, that if my Stateless Session Bean accesses getBs() after having retrieved A before it returns, then it works also from the JSF page. From my current understanding, eager fetching should have had the same effect....???!!!
Anyway, I read the EJB persistence specs and in chapter 5.6.3 it says, that:
Propagation of persistence contexts only applies within a local
environment. Persistence contexts are not propagated to remote tiers.Does this mean, that Entities get detached at this point? But why does it then work even remotely, when I access getBs() from the SLSB?
Furthermore, if I used a Local Interface for the SLSB, can I then expect this to work without the call to getBs()?
Would it have an impact to inject an EntityManager into the BackingBean? From my current understanding, container-managed transactions are demarcated through the SLSB, so the transaction would end there anyway, so I suppose injecting the EntityManager into the BackingBean does NOT have an impact. Can anybody confirm this?
Many Thanks in advance,
Stephan

Hi,
Hi Stephan. Great questions. Answers inline.
I am currently improving my first EJB3 / JSF
prototype in order to get a good feeling for that new
technology. I am using Sun Appserver 9, NetBeans
5.5.
I have the followiong design-setup:
JSF-BackingBean ===uses===> @Remote Stateless Session
Bean ===fetches==> EntityBeans
The general question is: 1.) Where do EntityBeans get
detached in a JSF setup It's independent of JSF itself. The detaching behavior depends on what kind of interface (local vs. remote) is used to access the Stateless Session bean and what the transactional settings are for the invocation. First off, any Java Persitence API entities passed through a Remote interface become detached when received by the caller, even if the caller is in the same application as the callee.
If the related entities were not fetched before the detachment, they will not be available after detachment.
If you use a Local interface to access the Stateless Session Bean, detachment will occur when the transaction within which the entities were fetched commits or rolls back. My guess is you're using the default tx behavior (CMT/TX_REQUIRED) for the SLSB business method and not demarcating transactions in the JSF bean, so the entities will become attached when the SLSB method returns.
and 2.) does detaching mean,
that I cannot traverse the relations anymore, even if
I have eager fetching configured`?You can try traversing afterwards but there's no guarantee the requested
entities will be there. If they happened to have been fetched before
the detachment, they will be returned. Otherwise, they won't be found and
since the entities are no longer associated with an entity manager, it's too
late for them to be fetched.
>
Let me also ask some more detailed questions:
The Backing Bean stores the Entity Bean "A" in an
attribute. So far so good. My Entity A has a 1:n
association to Entity B with eager fetching
configured in the annotation. When I now want to
access the relation getBs() from within a JSF forEach
statement, I keep getting an error from the
persistence layer.
I found out, that if my Stateless Session Bean
accesses getBs() after having retrieved A before it
returns, then it works also from the JSF page. From
my current understanding, eager fetching should have
had the same effect....???!!!That only applies to a managed entity. When it's in the
detached state, the eager fetching doesn't apply since
it's not associated with an EntityManager.
Anyway, I read the EJB persistence specs and in
chapter 5.6.3 it says, that:
Propagation of persistence contexts only applieswithin a local
environment. Persistence contexts are not propagatedto remote tiers.Persistence context propagation refers to the case where
two different Java EE components within the same transaction both access a
container-managed transactional EntityManager. If both components are within
the same application and running on the same JVM, they will "see" the same
persistence context. This is magic performed by the container to preserve
the transactional semantics from the Entity Bean model in J2EE 1.4 and earlier.
E.g, if your JSF bean had a container-managed entity manager and started
a global transaction, then invoked a Stateless Session Bean method with
TX_REQUIRED, the JSF bean's EntityManager would have the same
state as the Stateless Session Bean's EntityManager, without having to explicitly
pass references to entity classes between them.
>
Furthermore, if I used a Local Interface for the
SLSB, can I then expect this to work without the call
to getBs()? Only if you start a global transaction before invoking the SLSB and call
getBs() before committing the tx.
Would it have an impact to inject an EntityManager
into the BackingBean? Yes, that's one way to do it, but you also need to ensure that the same tx is being used. See below.
From my current understanding,
container-managed transactions are demarcated through
the SLSB, so the transaction would end there anyway,It depends on which transaction attribute is used. For the default tx attribute (TX_REQUIRED), if there is an existing transaction when the SLSB is accessed that will be used instead of the container starting a new one, which means it will not be committed by the container when the SLSB method returns.
so I suppose injecting the EntityManager into the
BackingBean does NOT have an impact. Can anybody
confirm this?Not true. See above. There's a good JavaOne talk on the topic of web-tier use of the Java Persistence API given by Linda Demichiel, Gavin King, and Craig McClanahan.
You can find it here :
http://developers.sun.com/learning/javaoneonline/2006/webtier/TS-1887.html
--ken
>
Many Thanks in advance,
Stephan

Do deleted entities get added to the validation listener?

Hi all,
I was reading about the 3 listeners in Jobinesh's [blog post|http://jobinesh.blogspot.com/2011/09/what-you-may-need-to-know-about.html] and got a doubt.
i. Do deleted entities get added to the validation listener? Does not make sense to me as there would be no validations to trigger on deleted entities.
ii. Is there some way to remove entities from Validation Listener? I see that there are method to remove the entities from other two listeners.
Thanks,
Srini

Hi Frank,
Was testing this and was surprised to find that validation listeners were not affected when I deleted entities. Maybe I missed something.
If they get added, is there some way of removing the entity from the validation listener?
Thanks,
Srini

How do you define which character set gets embedded with a font embedded in the library (i.e. Korean)?

I have project that uses a shared fonts. The fonts are all
contained in a single swf ("fonts.swf"), are embedded in that swf's
library and are set to export for actionscript and runtime sharing.
The text in the project is dynamic and is loaded in from
external XML files. The text is formatted via styles contained in a
CSS object.
This project needs to be localized into 20 or so different
languages.
Everything works great with one exception: I can’t
figure out how to set which character set gets exported for runtime
sharing. i.e. I want to create a fonts.swf that contains Korean
characters, change the XML based text to Korean and have the text
display correctly.
I’ve tried changing the language of my OS (WinXP) and
re-exporting but that doesn’t work correctly. I’ve also
tried adding substitute font keys to the registry (at:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
NT\CurrentVersion\FontSubstitutes) as outlined here:
http://www.quasimondo.com/archives/000211.php
but the fonts I added did not show up in Flash's font menue.
I’ve also tried the method outlined here:
http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=tn_16275
to no avail.
I know there must be a simple solution that will allow me to
embed language specific character sets for the fonts embedded in
the library but I have yet to discover what it is.
Any insight would be greatly appreciated.
http://www.quasimondo.com/archives/000211.php
http://www.adobe.com/cfusion/knowledgebase/index.cfm?id=tn_16275

Thanks Jim,
I know that it is easy to specify the language you want to
use when setting the embed font properties for a specific text
field but my project has hundreds of text fields and I'm setting
the font globally by referencing the font symbols in a single swf.
I have looked at the info you've pointed out but wasn't
helped by it. What I'd like to be able to do is to tell Flash to
embed a language specific character-set for the font symbols in the
library. It currently is only embedding Latin characters even
though I know the fonts specified contains characters for other
languages.
For example. I have a font symbol in the libary named
"Font1". When I look at its properties I can see it is spcified as
Tahoma. I know the Tahoma font on my system contains the characters
for Korean but when I compile the swf it only contains Latin
characters (gylphs) - this corresponds to the language of my OS (US
English). I want to know how to tell Flash to embedd the Korean
language charaters rather than or as well as the Latin characters
for any given FONT SYMBOL. If I could do that, then, when I enter
Korean text into my XML files the correct characters will be
available to Flash. As it is now, the characters are not available
and thus the text doesn' t display.
Make sense?
Many thanks,
Mike

Cannot save webpage (.html file) because get error sayting that a " .js" file could not be saved, because the source file could not be read. Any ideas where my problem is? Thx.

Every time I attempt to save a webpage (.html format) I get a message indicating that some .js-type file was not saved because the source file could not be read.
I did some "cleanup" of add-ons because there were so many. Is it possible I deactivated one that I need to read .js files, or could/would it be something else?
Thanks.

Please help.
It is getting worse
Adobe flash player is crashing. I already uninstalled and re installed the latest ver. Also it is hanging randomly.
Please help.

Handling Character Entities - Java Mapping Issue

Hi Experts,
    I need to replace the character entities in my input XML. But, the problem is the java mapping I've written isn't replacing the character entities as expected. For example if my input XML contains <NAME>&><XYZ</NAME>, then the ouput is <NAME>&amp:&gt:<0001&lt:/NAME>, whereas it should be <NAME>&amp:&gt:&lt:0001</NAME>.
Note: I've used : instead of ; just to show it properly SDN.
Can any of you share the code for the same if you've used it already?
Thanks a lot in advance.
Regards,
Hussain.

Hi Pooja,
    Thanks for your prompt reply.
Are you trying to use the java mapping just to handle the character entities or your interface itself only has a java mapping?
               - I'm using Java Mapping just to handle the character entities. Say my input XML looks like
<?xml version="1.0" encoding="UTF-8"?>
<resultset>
<row>
<ID>&<1</ID>
<MESSAGE><![CDATA[<?xml version="1.0" encoding="UTF-8" ?><LGORT>&<0001</LGORT>]]></MESSAGE>
</row>
</resultset>
I need to replace &< in <ID> to &amp:&lt: and similarly for CDATA <LGORT>&amp:&lt:0001</LGORT> before I process it in XI. In my java mapping I read the whole XML as string (line by line as mentioned below) and try to replace the character entities using some logic, which isn't working properly.
StringBuffer buffer = new StringBuffer();
BufferedReader reader = new BufferedReader(new InputStreamReader(inputStream, "UTF-8"));
for (String lineRead = reader.readLine(); lineRead != null; lineRead = reader.readLine()) {
       buffer.append(lineRead);
I've also checked the thread mentioned by Srinivas. But, StringEscapeUtils.escapeXml() would replace all the character entities like &lt:?XML... , which would result in an invalid xml...
Please suggest.
Thanks,
Hussain.

How to parser a HTML page to get its variable and values?

Hi, everyone, here is my situation:
I need to parser a HTML page to get the variables and their associated values between <form>...</form> tag. for example, if you have a piece of HTML as below
<form>
<input type = "hidden" name = "para1" value = "value1">
<select name = "para2">
<option>value2</option>
</form>
the actual page is much complex than this. I want retrive pare1 = value1 and para2 = value2, I tried Jtidy but it doesn't reconginze select, could you recomend some good package this purpose? better with sample code.
Thanks a lot
Kevin

See for example Request taglib from Coldtags suite:
http://www.servletsuite.com/jsp.htm

Weblogic xss vulnerablity : html character entities getting decoded in jsp by ${} expression

Similar Messages

Maybe you are looking for