Fix XSS in API Responses in Quarkus
XSS in Quarkus APIs typically occurs when raw user input is reflected in responses without proper sanitization or context-aware encoding. While REST APIs primarily serve JSON, misconfigured 'Content-Type' headers (e.g., text/html) or 'dangerouslySetInnerHTML' on the frontend can turn a simple API response into an execution vector. As a researcher, you must ensure the backend enforces strict serialization and security headers.
The Vulnerable Pattern
@Path("/api/v1/user")
public class UserResource {
@GET
@Path("/profile")
@Produces(MediaType.TEXT_HTML)
public String getProfile(@QueryParam("username") String username) {
// VULNERABLE: Direct concatenation of unsanitized input into HTML context
return "Profile of: " + username + "
";
}
}The Secure Implementation
To kill XSS in Quarkus, stop returning raw HTML from your resource methods. Force 'application/json' using the @Produces annotation; this ensures the browser doesn't attempt to parse the response as an executable document. If you must use HTML, utilize a templating engine like Qute which provides automatic context-aware escaping. Additionally, implement a 'ContainerResponseFilter' to inject a strict Content-Security-Policy (CSP) and 'X-Content-Type-Options: nosniff' header to prevent MIME-sniffing attacks.
@Path("/api/v1/user") public class UserResource { @GET @Path("/profile") @Produces(MediaType.APPLICATION_JSON) public UserDTO getProfile(@QueryParam("username") String username) { // SECURE: Use POJO for automatic JSON serialization // The frontend is responsible for safe rendering return new UserDTO(username); } }
// Add a Global Security Filter for CSP @Provider public class SecurityHeaderFilter implements ContainerResponseFilter { @Override public void filter(ContainerRequestContext req, ResponseContext res) { res.getHeaders().add(“Content-Security-Policy”, “default-src ‘self’;”); res.getHeaders().add(“X-Content-Type-Options”, “nosniff”); } }
Your API Responses API
might be exposed to XSS
74% of API Responses apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.