Prevent XSS attempts on a Tomcat/Struts 1 web application (without source code)

Question

A 3rd party web application has a cross-scripting security issue. There is one page with three fields which are not sanitized. The vendor will not provide a timely fix and I need to.

The application is running in Tomcat and uses Struts 1. The action for the bad page looks like this:

<action
  path="/badpage"
  type="com.badvendor.BadAction"
  name="badForm"
  scope="request"
  validate="true"
  input="/otherbadpage.do">
  <forward name="failure" path="/otherbadpage.do"/>
  <forward name="success" path="/otherbadpage.do"/>
</action>

I do not have the source code for the action class.

What is the easiest way to get between the request and the action to sanitize the input (or even just cause an error on bad input)?

Answer 1

You can:

1. Change the mapping to point to a different action (yours). Forward control to the action in question after sanitizing input.
2. Write a servlet filter to intercept that particular URI.