Merge pull request #10408 from giper45/patch-1

Updated vulnerable XSS.java version

Author: atorralba

java/ql/src/Security/CWE/CWE-079/XSS.java

@@ -1,8 +1,9 @@
 public class XSS extends HttpServlet {
 	protected void doGet(HttpServletRequest request, HttpServletResponse response)
 	throws ServletException, IOException {
-		// BAD: a request parameter is written directly to an error response page
-		response.sendError(HttpServletResponse.SC_NOT_FOUND,
+		// BAD: a request parameter is written directly to the Servlet response stream
+		response.getWriter().print(
 				"The page \"" + request.getParameter("page") + "\" was not found.");
+
 	}
 }

java/ql/src/Security/CWE/CWE-079/XSS.qhelp

@@ -18,7 +18,7 @@ reference.</p>
 </recommendation>
 <example>
 
-<p>The following example shows the page parameter being written directly to the server error page,
+<p>The following example shows the <code>page</code> parameter being written directly to the page,
 leaving the website vulnerable to cross-site scripting.</p>
 
 <sample src="XSS.java" />