How to fix Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) with error message?

Question

We use web control adapter in our login page. Recently we run VeraCode on our web application. In following function, we got CWE80, Improper Neutralization of Script-Related

Answer 1

You can also use Apache Commons Lang3 library StringEscapeUtils. It has various methods for encoding the strings. e.g. escapeXml(string), escapeHtml(string) etc.

rev.ErrorMessage = StringEscapeUtils.escapeHtml(msg);