Spring Misconfiguration: HTML Escaping disabled
Description
This Spring web application is configured to disable the automatic HTML escaping for Spring tags which may lead to Cross-Site Scripting vulnerabilities.
Remediation
It's recommended to enable HTML escaping for Spring tags. This can be configured from web.xml like in the example below: <pre> <web-app> ... <context-param> <param-name>defaultHtmlEscape</param-name> <param-value>true</param-value> </context-param> ... </web-app> </pre> At page level, it is defined as a tag-declaration. <pre> <spring:htmlEscape defaultHtmlEscape="true" /> </pre>