XSS in Portlet

[h3xstream]

Similar to the XSS in servlet and JSP detector. A detector could be made to detect the following patterns:

import javax.portlet.*;
import java.io.*;

public class HelloWorld extends GenericPortlet {

   public void init (PortletConfig portletConfig) throws UnavailableException, PortletException
   {
      super.init(portletConfig);
   }

   public void doView(RenderRequest request, RenderResponse response)
                      throws PortletException, IOException
   {
      response.setContentType("text/html");
      PrintWriter writer = response.getWriter();
      String user = request.getParameter("user");
      writer.println("<h1>Hello "+user+"!</h1>");
    }

}

import org.apache.jetspeed.portlet.*;
import java.io.*;

public class HelloWorld extends PortletAdapter {

   public void init (PortletConfig portletConfig) throws UnavailableException
   {
      super.init(portletConfig);
   }

   public void doView(PortletRequest request, PortletResponse response)
                      throws PortletException, IOException
   {
      PrintWriter writer = response.getWriter();
      String user = request.getParameter("user");
      writer.println("<h1>Hello "+user+"!</h1>");
   }

}

Ref: https://www.ibm.com/support/knowledgecenter/SSHRKX_8.0.0/dev/wpsbscfg.html