Enforce Server-Side Validation and Output Encoding for Upload Metadata to Prevent XSS

Issue:

The current implementation of the document upload functionality processes metadata parameters provided by the client without enforcing strict server-side validation. Fields such as PT_UPLOADED_DOC_TYPE, PT_BPM_TASK_ID, PT_ISSUANCE_DATE, and PT_EXPIRY_DATE are accepted and processed as-is.

This behavior allows manipulation of input values, including setting invalid or out-of-range values (e.g., past dates for PT_EXPIRY_DATE) that can intentionally trigger application error-handling logic.

Additionally, the application’s error-handling mechanism reflects user-supplied metadata (specifically PT_UPLOADED_DOC_TYPE) in the response without applying proper output encoding. This creates a vulnerability where malicious scripts embedded in metadata parameters can be executed in the user’s browser when an error response is generated.

Requested Enhancement:

Implement strict server-side validation for all upload metadata parameters, including:
Whitelisting or controlled value sets for fields like PT_UPLOADED_DOC_TYPE
Proper data type and range validation for date fields such as PT_ISSUANCE_DATE and PT_EXPIRY_DATE
Ensure all user-supplied input is properly encoded before being included in any server response, including error messages
Update error-handling logic to avoid reflecting raw user input directly in responses
Introduce centralized input validation and output encoding mechanisms across upload and metadata processing components

Expected Outcome:
Improved security posture by preventing cross-site scripting (XSS) vulnerabilities and ensuring robust handling of client-supplied metadata in document upload workflows.

Suggested Areas and Fixes:

1) Enforce strict server-side validation

Do NOT rely on UI validation.

Validate each parameter (example):

PT_EXPIRY_DATE
* Must be a valid date
* Must be ≥ current date (if business rule applies)

PT_UPLOADED_DOC_TYPE
* Whitelist allowed values (e.g., enum or controlled list)
* Reject anything outside expected values

Example logic (pseudo):

if (!allowedDocTypes.contains(docType)) {
throw new ValidationException("Invalid document type");
}

2) Encode ALL output (critical fix)

Every value rendered into HTML must be encoded.

In Java (typical BAW stack) use:
StringEscapeUtils.escapeHtml4()

OR

OWASP Encoder: Encode.forHtml(userInput)

>> This alone breaks the XSS payload.

3) Fix error handling design

Currently: Error handler reflects raw user input

That’s unsafe by design, instead:

Return generic messages: "Invalid document metadata" and log detailed values server-side only

4) Do not use user input in UI without context-aware encoding

Different contexts require different encoding:

HTML body >> HTML encoding
JavaScript >> JS encoding
URL >> URL encoding

5) Add centralized validation layer

Instead of validating in multiple places:

Add validation in:
* REST layer / servlet layer
* BEFORE processing or persistence

6) Security headers (defense-in-depth)

Even after fixing code, add:

* Content Security Policy (CSP)
* X-XSS-Protection (legacy but harmless)
* X-Content-Type-Options

Example CSP:

Content-Security-Policy: default-src 'self'; script-src 'self'