Are they a way to improve JSP security?

Question

I added JSP compilation to my project, but, nevertheless, the compiler does not check for invalid macros such as $ {object.value}, where the object does not have a getter for the value.

I am wondering if there are other ways to guide the JSP compiler (jspc) for this. I considered some options: 1. Explicitly declare an object type inside JSP (jsp: useBean?). 2. Using the construction <% =%> instead of $ {}

But none of this helped.

I would be grateful if someone shared their experience in this area.

Answer 1

Use <jsp:useBean id="yourId" scope="request" type="com.blah.YourClass"/> and precompile the JSP.

Read this article for more details.

Answer 2

Not unless you want to radically redesign how JSPs run.

The HTML that it creates is also not safe.

The best you can do is use Model-2 MVC, where you have servlets that work with JSP. Let the servlet worry about binding, checking, and verifying that the necessary objects fall into the page area. Pages should be display-oriented only.

The idea of ​​the script is terrible. No one should put scriptlet code in the JSP. Learn and use JSTL.