J2EE engine filter to check for XSS input, SAP security note 1262675

SAP security note 1262675, "J2EE engine filter to check for XSS input", is a consulting note released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

You are using SAP CRM WebChannel or SAP E-Commerce and you want to add an additional possibility to avoid Cross Site Scripting (XSS).

Solution

This note is a consulting note. The changes described here are considered a modification of the web application. Further questions regarding these functions are not answered by support. Instead, they are processed as part of “Remote Consulting” and this is subject to an extra cost.

The note describes the possibility of using a filter. This filter checks every HTTP GET or POST request parameter for XSS relevant input. The user is redirected to a predefined error page if one of the parameters has XSS content inside.

How to implement the filter:

• Open the web.xml file in the root/WEB-INF folder of your J2EE application.
• Add the filter configuration. Insert the following lines between the <context-param> and <servlet> tags:

  </context-param>
  
  <filter>
    <filter-name>XSSFilter</filter-name>
    <display-name>XSSFilter</display-name>
    <filter-class>com.sapmarkets.isa.core.util.conv.XSSParameterFilter</filter-class>
  </filter>
  <filter-mapping>
    <filter-name>XSSFilter</filter-name>
    <url-pattern>*.do</url-pattern>
  </filter-mapping>
  <filter-mapping>
    <filter-name>XSSFilter</filter-name>
    <url-pattern>*.jsp</url-pattern>
  </filter-mapping>
  
  <servlet>

  You can modify the package and the class name as needed.

• Download the filter source code (XSSFilterClass.zip).
• Integrate the filter class into your development environment and update the redirect URL:

  ((HttpServletResponse) res).sendRedirect("PLEASE ENTER YOUR XSS ERROR PAGE!!!");

• Compile the class and rebuild your application to include the new filter.
• Deploy your modified application to activate the filter.
• The filter is active if no issues arise during deployment.

Reason and prerequisites

You want to increase the security of the application.

References

Affected components

• SAP-CRMISA: 4.0, 4.0_640
• SAP-CRMJAV: 5.0, 5.2, 6.0
• SAP-CRMWEB: 5.0, 5.1, 5.2, 6.0
• SAP-SHRWEB: 5.0, 5.2, 6.0
• SAP-SHRJAV: 5.0, 5.2, 6.0
• SAP-CRMAPP: 5.0, 5.2, 6.0
• SAP-SHRAPP: 5.0, 5.2, 6.0