SecurityInnovation/TMContentReview — Issue #77: Escape All Untrusted Data in HTML Contexts in JSP
Author: SergeTruth
Created: 2011-11-07 22:37:37+00:00
State: open

You need to define what the HTML context is and how it differs from other contexts.

"Use third-party libraries to escape displayed user input if needed. It may be the case that more sophisticated functionality may be required, for example for XML or JavaScript contexts. In such cases, it is recommended to use third party libraries, such as jTidy HTMLEncode, OWASP Reform, or OWASP ESAPI. Links to these libraries are available at the bottom of this page."
If you are in a JavaScript context you will not want to use jTidy HTMLEncode.