> I have a Servlet that checks for information and if there is an issue
> it forwards the message to presentation page (JSP). Now I want to stop
[quoted text clipped - 41 lines]
> }
> %>
Why not have the servlet store the long text in the request object
and have the JSP simply display it with a <%=whatever%> ?
Arne
teser3@hotmail.com - 16 Nov 2007 01:31 GMT
> tes...@hotmail.com wrote:
> > I have a Servlet that checks for information and if there is an issue
[quoted text clipped - 49 lines]
>
> - Show quoted text -
Thanks, I guess I dont know how I would do that?
I have showed data in JSP in the past as <%=whatever%> using a
JavaBean but not
sure how I would do that using Request object. Can you provide any
example?
Arne Vajhøj - 16 Nov 2007 02:03 GMT
>> tes...@hotmail.com wrote:
>>> I have a Servlet that checks for information and if there is an issue
[quoted text clipped - 44 lines]
> sure how I would do that using Request object. Can you provide any
> example?
if(mydata == 1)
{
val = "Error on the page";
}
else if(mydata == 34
{
val = "Duplicate issue.";
}
else
{
val = "Process message issue";
}
request.setAttribute("whatever", val);
RequestDispatcher dispatcher =
getServletContext().getRequestDispatcher("/pager.jsp");
dispatcher.forward(request, response);
Arne
teser3@hotmail.com - 16 Nov 2007 02:12 GMT
> tes...@hotmail.com wrote:
> >> tes...@hotmail.com wrote:
[quoted text clipped - 66 lines]
>
> - Show quoted text -
Arne,
Thanks for your time and guidance!
Greg Miller - 17 Nov 2007 15:39 GMT
> Why not have the servlet store the long text in the request object
> and have the JSP simply display it with a <%=whatever%> ?
Note, that using this exact method exposes your website to a cross site
scripting attack (see Wikipedia for an explanation). Before
automatically regurgitating text onto your page you need to make sure
all possible HTML is escaped.
Arne Vajhøj - 17 Nov 2007 15:44 GMT
>> Why not have the servlet store the long text in the request object
>> and have the JSP simply display it with a <%=whatever%> ?
[quoted text clipped - 3 lines]
> automatically regurgitating text onto your page you need to make sure
> all possible HTML is escaped.
No - it does not.
If you bothered reading the thread you replied to then you would
see that the values of whatever were a set of string literals and
not user input.
Arne
Greg Miller - 18 Nov 2007 02:05 GMT
> No - it does not.
>
> If you bothered reading the thread you replied to then you would
> see that the values of whatever were a set of string literals and
> not user input.
Regardless of how it's intended to be used, obviously pointing a
browser to
pager.jsp?mymessage=<script>alert('xss');</script> would
cause javascript to run.
Arne Vajhøj - 18 Nov 2007 02:20 GMT
>> No - it does not.
>>
[quoted text clipped - 6 lines]
> pager.jsp?mymessage=<script>alert('xss');</script> would
> cause javascript to run.
No.
PHP in a bad setup works this way. But JSP does not and never has.
Query string variables are not automatically transferred into
request attributes or Java variables.
Arne