...
For example, if the user supplies the input string "<kitten><#catgifs>", the url returned is "https://example.com?query=<kitten><#catgifs>" which is not a valid URL.
...
If the user supplies the input string "#YOLO2018<#catgifs>", the url returned is "https://example.com?query=%3Ckitten%3E%3C%23catgifs%3E" which is a valid URL.
Applicability
...
| Tool | Version | Checker | Description | ||||||
|---|---|---|---|---|---|---|---|---|---|
| The Checker Framework |
| Tainting Checker | Trust and security errors (see Chapter 8) | ||||||
| Parasoft Jtest |
| CERT.IDS51.TDRESP CERT.IDS51.TDXSS | Protect against HTTP response splitting Protect against XSS vulnerabilities |
Related Vulnerabilities
The Apache GERONIMO-1474 vulnerability, reported in January 2006, allowed attackers to submit URLs containing JavaScript. The Web Access Log Viewer failed to sanitize the data it forwarded to the administrator console, thereby enabling a classic XSS attack.
...