OWASP Java Encoder
Contextual output encoding for Java 8+ to help prevent XSS. Version 1.6.0 provides a zero-dependency core, String and Writer APIs, and optional javax/Jakarta JSP adapters.
Historical note: this tab describes an obsolete unpatched Internet Explorer innerHTML round-trip issue. It is retained for context, not current usage guidance. The original material is archived in docs/archive/wiki-2019 in the repository. Use supported browsers and the current context guide.
The historical issue concerned Internet Explorer treating the grave accent (backtick, U+0060) as an HTML attribute delimiter during particular innerHTML round trips. It is distinct from JavaScript template-literal injection and the template-literal support introduced in Java Encoder 1.5.0.
The original wiki documented a nonstandard legacy browser parsing behavior. Historical demonstrations and attribution are preserved in the repository archive. They are not compatibility guarantees for current Java Encoder releases.
Reading markup through innerHTML and parsing the resulting string again could change how the affected Internet Explorer versions interpreted attributes. Output encoding cannot repair every unsafe DOM transformation. Avoid transferring untrusted text through HTML-parsing APIs.
Use supported browsers and textContent or other safe text APIs for untrusted text. When user-authored HTML is required, use a policy-based HTML sanitizer. Do not adopt the archived grave-accent replacement workaround as current library guidance.
Project Resources
- Documentation
- GitHub
- Cross Site Scripting prevention cheatsheet
- Encode 1.6.0 Javadocs
- Output contexts and security boundaries
- Release verification guide
- Compatibility and runtime matrix
- Maven Central — encoder 1.6.0
- encoder-1.6.0.jar
- encoder-jakarta-jsp-1.6.0.jar
- encoder-jsp-1.6.0.jar
- Security policy and private vulnerability reporting
- ESAPI adapter retirement and migration guide
- v1.6.0 release notes, signatures and checksums
- 1.5.0 security and migration notes
Project Leaders
Jeremy Long
Project Leader
Jeremy Long co-leads OWASP Java Encoder and coordinates project maintenance, releases, and security response with Jim Manico.
Jim Manico
Project Leader
Jim Manico is the founder of Manicode Security, where he trains developers and organizations in secure coding. He is an OWASP Distinguished Lifetime Member, a Java Champion, and the author of Iron-Clad Java. He leads the OWASP AISVS, Cheat Sheet Series, Java HTML Sanitizer, and Java Encoder projects.
Major Contributors
Recognizing key contributors who have made significant impact on this project.
Jeff Ichnowski
Original Author
Original author of OWASP Java Encoder.
Project Information
Requirements
- Java 8 or later at runtime
Slack