OWASP/owasp-java-encoder

OWASP JSP/EL Function Is Removing/Not Correctly Displaying Characters

tomtom01 opened this issue · 1 comments

I'm using the OWASP Java Encoder API to prevent XSS in my program, but when I use the JSP/EL function as shown on the project's website, https://www.owasp.org/index.php/OWASP_Java_Encoder_Project#tab=Use_the_Java_Encoder_Project I've noticed that using this causes the special characters that are being encoded to not display along with the rest of the content. For example, with the string:
(123)-456-7890, it will instead display as:
123?456?7890

I am implementing it as such:
<sbean:define id="name" value="${enc:forHtml(prospect.name)}" /><%=name %>

One possible cause for this is that the program i'm working on already contains a separate XSS filter, but some weak spots were found so I am using this API in addition to the filter. Is this the cause, or is there something else going on here? If this is the reason, how can I tell OWASP Java Encoder to ignore that data?

Thanks!

This question is no longer needed. I have determined that the existing XSS filter is working correctly, and that the problem was accidental double encoding.