Handling Java Web Application Input, Part 2

Overview

This paper explains the threat of cross-site scripting, as well as looking at correctly handling exceptions in J2EE web applications. An attacker can initiate an attack through a web browser by constructing attack strings, sending them via a HTTP get request through URL tampering, via a HTTP post request through HTML forms, or by other means. It is therefore critical that any possibility for data being input into an application from an external source is carefully analyzed, and secure coding practices put in place to meet the specific validation needs of an application in order to neutralize any threats.