A Cross Site Scripting attack attempts to echo back a malicious script in the HTML returned from a trusted site. Since the script is echoed back from a trusted site, it runs in the context of that site. This kind of attack can be prevented by ensuring all output to HTML stream is encoded. This prevents other forms of injection attacks such as HTML Injection and Java Script Injection. The simplest way of achieving this is to build JSP pages using only tags, eliminating the use of scriplets ("<%....%>") and expressions ("<%=...%>"). All new JSP pages should be built in this manner leveraging JSTL and the expression language.

<% Customer cust = (Customer) session.getAttribute("customer"); %>

<%= cust.firstName() %>

<c:out value="${customer.firstName}" />

It may not be practical to modify all existing JSP pages. In this case, the output of all expressions will need to be manually HTML encoded. This can be done via utility classes such as the escapeHTML methods on the StringEscapeUtils class within the Jakarta Commons Lang package.

<% Customer cust = (Customer) session.getAttribute("customer"); %>

<%= StringEscapeUtils.escapeHtml( cust.firstName() ) %>