Security issues caused by nested JSP page values passed in JS code

In JSP, we often use string Str=request.getparameter ("St"), this way to get the value, and then introduce the Var str=<% in the JS code str%> There is a security problem with this writing, The problem can be measured with fortify software. Hint cross-domain security problem, in fact, not cross-domain can also solve this problem, put the variable into the request domain, with the El expression to get

So write: String Str=request.getparameter ("St"); Request.setattribute ("str", str); When you accept Var str=${str}, you can avoid this security vulnerability.

Security issues caused by nested JSP page values passed in JS code