Take the 2-minute tour ×  I have a struts 1.2 application with
multiple different applications housed in it, each with their
own config file. The issue I have comes down to an XSS attack.
Each app is setup as follows...   Where the app1, app2, and app3
are folders. The issue I have is that a user could do the
following...  http://www.myapp.com/app/app1<img src=a
onerror=alert("alert")>/welcome.action  Causing an XSS attack on
the site. The issue is since the "app1" is a folder I can't use
a servlet filter to prevent malicious code there. Any advice
from anyone?  share|improve this question Servlet filters are
mapped to URL patterns. What the underlying implementation of
those patterns are is irrelevant. –  Dave Newton Aug 1 '13 at
19:53 add comment  1 Answer  Create a Servlet filter and map it
to URL pattern /* as first filter in the chain. Then all
requests will be routed through this filter. In the
filter.doFilter() handle special characters like "<". Better
look at OWASP ESAPI (java) project to handle thes