Take the 2-minute tour ×

I have a struts 1.2 application with multiple different applications housed in it, each with their own config file. The issue I have comes down to an XSS attack. Each app is setup as follows...


Where the app1, app2, and app3 are folders. The issue I have is that a user could do the following...

http://www.myapp.com/app/app1<img src=a onerror=alert("alert")>/welcome.action

Causing an XSS attack on the site. The issue is since the "app1" is a folder I can't use a servlet filter to prevent malicious code there. Any advice from anyone?

share|improve this question
Servlet filters are mapped to URL patterns. What the underlying implementation of those patterns are is irrelevant. –  Dave Newton Aug 1 '13 at 19:53
add comment

1 Answer

Create a Servlet filter and map it to URL pattern /* as first filter in the chain. Then all requests will be routed through this filter. In the filter.doFilter() handle special characters like "<". Better look at OWASP ESAPI (java) project to handle these things: http://code.google.com/p/owasp-esapi-java/

share|improve this answer
add comment

Your Answer


