Fix cross-site scripting in Java and Spring Boot

1. Find every th:utext and every unescaped inlined expression [(...)]; both write the value as raw HTML.
2. Change them to th:text (or [[...]] inlining), which escapes & < > " and '. Bind attributes with th:text's attribute cousins (th:title, th:alt, th:attr); Thymeleaf escapes those too and offers no unescaped attribute form.
3. For a URL in th:href or th:src, do not rely on escaping: check the value in the controller or with #strings and render the link only for an http/https (or mailto) scheme, or a relative URL.
4. For rich text that must keep some HTML, sanitize it in Java with the OWASP Java HTML Sanitizer or jsoup's safelist Cleaner, then output the result with th:utext; never a regex.
5. Add regression tests that render this card's payloads and parse the HTML with jsoup, asserting no script element, no on* attribute and no non-http(s) link, next to functional tests for <, & and quotes.
6. Do not return exception messages to clients; keep server error detail in the logs.

The three implementations share one API and one test suite; only the code below changes. The tests load the one that IMPL names.

<!--/* Thymeleaf has no unescaped attribute processor: th:alt escapes even here. */-->
    <img src="/avatar.svg" th:alt="${name}" width="64" height="64">
    <h1 th:utext="${name}">Name</h1>
    <p class="bio" th:utext="${bio}">Bio</p>

<img src="/avatar.svg" th:alt="${name}" width="64" height="64">
<h1 th:text="${name}">Name</h1>
<p class="bio" th:text="${bio}">Bio</p>

<!--/* Escaping cannot make a URL safe: javascript:alert(1) has nothing to escape.
       Link only to http and https URLs. */-->
    <a th:if="${#strings.startsWith(website, 'https://') or #strings.startsWith(website, 'http://')}"
       th:href="@{${website}}">Website</a>

<!--/* The bio may contain formatting, so print it raw, minus any <script> elements. */-->
    <img src="/avatar.svg" th:alt="${name}" width="64" height="64">
    <h1 th:text="${name}">Name</h1>
    <p class="bio" th:utext="${bio.replaceAll('(?is)<script.*?>.*?</script>', '')}">Bio</p>

The exploit tests send the attack and check that it fails; functional tests next to them keep ordinary requests working, so a fix that rejects everything fails too.

// Exploit: what a browser would run from the page must stay inert.

/** No script elements, no event-handler attributes, and only http(s) links. */
private static void assertNothingExecutable(Document page) {
    assertThat(page.select("script")).as("script element").isEmpty();
    List<String> handlers = page.getAllElements().stream()
            .flatMap(e -> e.attributes().asList().stream()
                    .filter(a -> a.getKey().startsWith("on"))
                    .map(a -> e.tagName() + " " + a.getKey()))
            .toList();
    assertThat(handlers).as("event-handler attribute").isEmpty();
    for (String href : links(page)) {
        assertThat(urlScheme(href)).as("scheme of link %s", href).isIn("", "http", "https");
    }
}

/**
 * The scheme a browser uses for href, or "" for a relative URL. Like the URL Standard's
 * parser, strip leading and trailing C0 controls and spaces (String.trim does exactly that)
 * and delete every tab and newline before looking for the scheme.
 */
static String urlScheme(String href) {
    String url = href.trim().replaceAll("[\t\n\r]", "");
    Matcher scheme = Pattern.compile("^([A-Za-z][A-Za-z0-9+.-]*):").matcher(url);
    return scheme.find() ? scheme.group(1).toLowerCase(Locale.ROOT) : "";
}

@Test
void exploitScriptElementInTheBioDoesNotRun() throws Exception {
    assertNothingExecutable(profile("name", "Mallory", "bio", "<script>alert(document.domain)</script>"));
}

@Test
void exploitEventHandlerAttributeInTheBioDoesNotRun() throws Exception {
    assertNothingExecutable(profile("name", "Mallory", "bio", "<img src=x onerror=alert(document.domain)>"));
}

@Test
void exploitQuoteInTheNameCannotBreakOutOfTheAltAttribute() throws Exception {
    String name = "\" onerror=\"alert(document.domain)";
    Document page = profile("name", name);
    assertNothingExecutable(page);
    assertThat(avatarAlt(page)).isEqualTo(name);
}

@Test
void exploitJavascriptWebsiteIsNotLinked() throws Exception {
    assertNothingExecutable(profile("name", "Mallory", "website", "javascript:alert(document.domain)"));
}

@Test
void exploitTabInsideTheSchemeDoesNotSmuggleAJavascriptUrlThrough() throws Exception {
    // Browsers delete tabs and newlines from a URL before parsing it.
    assertNothingExecutable(profile("name", "Mallory", "website", "java\tscript:alert(document.domain)"));
}

• th:utext is the Thymeleaf footgun, and so is the [(...)] inlining form; both skip escaping. th:text and [[...]] escape. Reserve the unescaped forms for HTML you produced.
• Thymeleaf escapes every attribute set with th:* (there is no th:utext for attributes), so quoted-attribute injection does not happen through th:title or th:attr — which is why this card's attribute-breakout payload is caught even by the vulnerable template.
• Thymeleaf link expressions @{...} resolve context paths and URL parameters; they do not sanitize the scheme, so @{${website}} still emits a javascript: link. The 'wrong' template trusts @{...} for exactly this and fails.
• HTML-escaping a URL does not disarm javascript:alert(1); it has no HTML metacharacters. URLs need a scheme allowlist, not escaping.
• A blocklist misses mixed case, a tab or newline inside the scheme, and other schemes (data:, vbscript:). Allowlist http/https instead.
• th:utext and th:href run under Thymeleaf's restricted expression mode, which blocks new, static T(...) access and ${param.*}, but that is defence in depth, not input validation — a plain context string such as javascript:alert(1) passes straight through.
• The web-layer slice test (@WebMvcTest) renders the real template, so it exercises the actual escaping; a controller unit test that never renders would miss the bug.

1. Run the tests in all three modes: IMPL=fixed must pass; IMPL=vulnerable and IMPL=wrong must fail (node ../../run-all.mjs java-spring does this for you).
2. There is no Semgrep or Find Security Bugs rule for Thymeleaf XSS, so grep the templates for th:utext and review each by hand, and lean on the regression tests.
3. Against your own endpoint, send bio=<img src=x onerror=alert(1)> and website=javascript:alert(1) and confirm the tag shows as text and the link is dropped.

What each rule reported when it was run on this card's code, or what its source shows it covers where it was not run. A rule that exists for the weakness does not always catch it.

Download the project, install its dependencies once (this step needs the network), then run the tests against each implementation from the xss/java-springfolder. Maven runs with JDK 21 (set JAVA_HOME).

mvn -B -q test

# Expected: every test passes
IMPL=fixed mvn -B -o -q test

# Expected: an exploit test fails
IMPL=vulnerable mvn -B -o -q test

# Expected: a test fails
IMPL=wrong mvn -B -o -q test

Each run writes a JUnit report to target/surefire-reports/TEST-*.xml. From the top folder of the download, node run-all.mjs xss/java-spring runs all three modes and checks the expected results.

Download the project ZIP, 18 KB

Verified

Toolchain

• java 21.0.12.1
• maven 3.9.16
• springBoot 4.1.1
• thymeleaf 3.1.5.RELEASE
• junitJupiter 6.0.3
• jsoup 1.23.2

Matrix

fixed: 9 of 9 tests pass; vulnerable: 6 of 9 tests fail (4 exploit tests); wrong: 4 of 9 tests fail (3 exploit tests)

Versions and results hold for the toolchain above. The card's tests are the check: run them with your own versions before relying on the fix.

References

1. OWASP Cross Site Scripting Prevention Cheat Sheet
2. Thymeleaf: Using Thymeleaf — Unescaped Text (th:text vs th:utext)
3. Thymeleaf: Appendix D — Expression Restrictions (restricted mode)
4. Spring Security: protection against XSS and output encoding
5. OWASP Java HTML Sanitizer (for rich text)
6. jsoup: cleaning HTML with a Safelist
7. WHATWG URL Standard: URL parsing (scheme, tab and newline removal)

Attack patterns:

• CAPEC-63 at MITRE