Dealing with XSS in struts

[jeff mutonho]

Hi
What are the recommendations to deal with cross-site scripting in
struts?
I'm got an app that a use can access at a URL , let's call it
http://localhost/myapplication , now doing something like

http://localhost/myapplication/applicationInit.do?mode
=<script<alert(document.Kookie)<script/<
Kookie is meant to be cookie
reveals a pop-up box containing the currently set cookies.

How can I block that from happening?Is there a way of encoding a form
bean?
Will encoding every field/attribute in the form bean , be a viable option?
jeff mutonho

[jeff mutonho]

Hi
REPOST:
What are the recommendations to deal with cross-site scripting in
struts?
I'm got an app that a use can access at a URL , let's call it
http://localhost/myapplication , now doing something like
http://localhost/myapplication/applicationInit.do?mode
=<script>alert(document.Kookie)<script/>
reveals a pop-up box containing the currently set cookies.
( Kookie here is meant to be cookie )
How can I block that from happening?Is there a way of encoding a form
bean?
Will encoding every field/attribute in the form bean , be a viable option?
jeff mutonho