vetkit.java.xss.servlet-response-writer
Request data is written to the HTTP response without HTML encoding (cross-site scripting).
Last updated:
Suite: Security
java
Request data is written to the HTTP response without HTML encoding (cross-site scripting).
Category: SECURITY · Engine rule severity: ERROR
How to fix it
Render through a template engine with auto-escaping, or encode for the output context (e.g. OWASP Java Encoder Encode.forHtml) before writing; set a non-HTML Content-Type for data responses.
References
Source: packages/engine/rules/sast/java.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.