JSP XSS audit: escape unescaped output across legacy JSPs

[aaronbrethorst]

CodeRabbit flagged a class of XSS issues across the webapp's legacy JSPs in PR #29. None were introduced by that PR — it only touched these files to migrate them to the new `<t:layout>` shell — but they should be hardened. Grouped by fix pattern.

1. Unescaped `${param.a}` (and similar) in HTML attribute context

`request.getParameter("a")` is rendered straight into a hidden `<input value="...">`. A crafted URL like `?a="><script>alert(1)</script>` injects script. Fix with `<c:out value="..."/>` or `fn:escapeXml(...)`.

• `transitclockWebapp/src/main/webapp/reports/avlMapByRouteParams.jsp` (line 18)
• `transitclockWebapp/src/main/webapp/reports/avlMapByVehicleParams.jsp` (line 18)
• `transitclockWebapp/src/main/webapp/reports/predAccuracyCsvParams.jsp` (line 18)
• `transitclockWebapp/src/main/webapp/reports/predAccuracyRangeParams.jsp` (line 18)
• `transitclockWebapp/src/main/webapp/reports/predAccuracyScatterParams.jsp` (line 18)
• `transitclockWebapp/src/main/webapp/reports/routePerformanceTable.jsp` (line 15) — flagged Critical
• `transitclockWebapp/src/main/webapp/reports/schAdhByTimeParams.jsp` (line 18)
• `transitclockWebapp/src/main/webapp/reports/scheduleHorizStopsParams.jsp` (line 18)
• `transitclockWebapp/src/main/webapp/reports/scheduleVertStopsParams.jsp` (line 18) — flagged Critical
• `transitclockWebapp/src/main/webapp/reports/apiCalls/index.jsp` — also escapes `agencyId` in many `href` and `agencyName` in text contexts (use `<c:url>`+`<c:param>` for URLs, `<c:out>` for text)

2. Unescaped EL embedded in JavaScript string literals

`'${chartTitle}'` etc. — quotes/backslashes/newlines can break parsing or execute injected JS. Fix by JSON-encoding server-side (e.g. `StringEscapeUtils.escapeEcmaScript`) or rendering into a hidden `

` and reading with `textContent`.

• `transitclockWebapp/src/main/webapp/reports/predAccuracyRangeChart.jsp` (line 127, 183) — flagged Critical
• `transitclockWebapp/src/main/webapp/reports/predAccuracyScatterChart.jsp` (lines 31–43, 116) — flagged Critical
• `transitclockWebapp/src/main/webapp/reports/predAccuracyIntervalsChart.jsp` (lines 117, 183–189)
• `transitclockWebapp/src/main/webapp/reports/schAdhByRouteChart.jsp` (lines 3–7, 236) — also embeds raw `
  ` from request data
• `transitclockWebapp/src/main/webapp/reports/schAdhByStopChart.jsp` (lines 20–23, 232–233) — flagged Critical, also feeds into `.html()`
• `transitclockWebapp/src/main/webapp/reports/schAdhByTimeChart.jsp` (lines 3–8, 21–25, 118–120, 181, 203–210, 245)

3. Client-side `innerHTML` / popup HTML built from API payloads

If the API ever returns tainted data (or is itself a vector), these become live HTML. Use `textContent` or an `escapeHtml` helper.

• `transitclockWebapp/src/main/webapp/reports/lastAvlReport.jsp` (lines 28–31) — `row.insertCell(n).innerHTML = vehicleInfo.*`
• `transitclockWebapp/src/main/webapp/reports/vehicleEventReport.jsp` (lines 33–35) — same pattern
• `transitclockWebapp/src/main/webapp/maps/schAdhMap.jsp` (lines 47–60) — Leaflet popup string-concatenated from `vehicle.id`, `routeName`, `headsign`, `block`, `driver`

4. Status / monitor text rendered raw

• `transitclockWebapp/src/main/webapp/status/serverStatus.jsp` (lines 35–43) — `${rmiError}`, `${monitorResult.type}`, `${monitorResult.message}` should all be `<c:out>`

Source

• PR Modernize webapp UI: Tailwind shell, Stimulus, layout tags #29: Modernize webapp UI: Tailwind shell, Stimulus, layout tags #29
• CodeRabbit review: Modernize webapp UI: Tailwind shell, Stimulus, layout tags #29 (review)