In the below JSP page Checkmax shows a Reflected XSS attack as I am using ${pageContext.reqest.contextPath} variable in JavaScript source. I have tried using
<script type="text/javascript" src=" <c:url value="${pageContext.request.contextPath}/js/viewone.js" />">
but it did not work.
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "https://www.w3.org/TR/html4/loose.dtd">
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>jsp page</title>
<script type="text/javascript" src="${pageContext.reqest.contextPath}/js/viewone.js"></script>
</head>
<body>
<h3>all contents goes here </h3>
<br>
</body>
</html>
In your case, I think it's a CheckMarx false positive since
request.contextPathis not user input. Anyway, if you have to fix it, my experience is that you have to escape thepageContext.reqest.contextPathwith some libraries/method which CheckMarx "recognize".For example in my case, I used StringEscapeUtils.escapeHtml and CheckMarx is happy with that. Just make sure that you don't have any html entity in your
pageContext.reqest.contextPath, like "&", ">", ...