NetCOBOL for SPARC Architecture SAF Subroutines User's Guide

• COBW3_SANITIZE_CNV [Optional]
Chapter 3. How to Use SAF Subroutines 41
If characters that are vulnerable to a cross site scripting attack are found in
conversion data, those characters are automatically replaced. This process is referred
to as “sanitizing”.
For more details on cross site scripting, refer to Appendix P, Security, in the
NetCOBOL User’s Guide.
COBW3_SANITIZE_CNV is valid when either COBW3_SET_REPEAT_XX or
COBW3_SET_ REPEAT_NX is used. However, if the code set is Unicode,
COBW3_SANITIZE_CNV is also valid when COBW3_SET_ REPEAT_XN or
COBW3_SET_ REPEAT_NN is used.
Condition name Value Explanation
COBW3-SANITIZE-CNV-OFF LOW-VALUE Does not sanitize.
COBW3-SANITIZE-CNV-ON "1" Sanitize.
NOTE:
The sanitization procedure replaces the five characters that are vulnerable to a cross
site scripting attack (&, , “, ‘) with the following escape characters:
& → &
< → &lt;
> → &gt;
" → &quot;
' → &#39;
As a result, a single character is being replaced with 4-6 characters, increasing the
length of the sanitized data. This means that, depending on the content of the
unsanitized data, sanitizing data may cause the maximum data length (1024 bytes)
set in the Web parameter VALUE to be exceeded. If this happens, the sanitized data
is truncated automatically at 1024 bytes.
It is also possible that the escape characters themselves may be truncated. In this
case, the vulnerable character is deleted, not replaced. An example is given below.
Example: The unsanitized data area is 1021 bytes long. The first 1020 bytes
contain n characters that do not require sanitizing, but the last character is an
ampersand ( & ).
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&