How to sanitize HTML code in Java to prevent XSS attacks?

Preventing XSS (Cross-Site Scripting) in Java is crucial, and it can be achieved through several methods to sanitize HTML code. Below, I will detail two commonly used methods:

1. Using HTML Sanitizer Library

The most common and effective method is to use dedicated libraries to sanitize HTML code, ensuring all inputs are secure. A very popular and widely used library is OWASP Java HTML Sanitizer. This library allows us to define custom policies to whitelist allowed HTML elements and attributes, thereby preventing malicious script injection.

Example Code:

java
import org.owasp.html.HtmlPolicyBuilder;
import org.owasp.html.PolicyFactory;

public class HtmlSanitizerExample {
    public static void main(String[] args) {
        String unsafeHtml = "<script>alert('XSS')</script><p>Hello, world!</p>";

        PolicyFactory policy = new HtmlPolicyBuilder()
                .allowElements("p")
                .toFactory();

        String safeHtml = policy.sanitize(unsafeHtml);

        System.out.println(safeHtml);  // Output: <p>Hello, world!</p>
    }
}

In this example, we use OWASP HTML Sanitizer to define a policy that only allows the <p> tag. All other tags, including potentially dangerous <script> tags, are removed.

2. Using Java Standard Library for Encoding

Another approach is to encode HTML-related special characters. While not the best method for sanitizing HTML, it can be useful in certain cases for protecting against XSS in non-HTML content such as JavaScript variables or URL parameters.

Example Code:

java
import org.apache.commons.text.StringEscapeUtils;

public class EncodeHtmlExample {
    public static void main(String[] args) {
        String unsafeHtml = "<script>alert('XSS')</script><p>Hello, world!</p>";

        String safeHtml = StringEscapeUtils.escapeHtml4(unsafeHtml);

        System.out.println(safeHtml); // Output: &lt;script&gt;alert('XSS')&lt;/script&gt;&lt;p&gt;Hello, world!&lt;/p&gt;
    }
}

In this example, we use Apache Commons Text library's StringEscapeUtils.escapeHtml4 method to encode HTML. This escapes special characters in HTML, preventing them from being interpreted as valid HTML tags or JavaScript code.

Summary

Using dedicated HTML sanitization libraries is the most effective way to prevent XSS attacks, as these libraries are designed to account for various potential XSS attack vectors. When these libraries are not available, encoding special characters is a relatively safer alternative. Ultimately, the choice of protective measures should be based on specific application scenarios and security requirements.