Potential XSS errors when using information from HTTP requests

I've been seeing a lot of redirects like the ones below in J2EE
programs.

1. response.sendRedirect(request.getParameter("REFERRER"));

2. response.sendRedirect(request.getRequestURI());
        
3. response.sendRedirect(request.getServletPath() + toPath);

Since the URL the user is being redirected to comes from the HTTP
header, I was wondering if forging parts of the header may lead to a
cross-site scripting exploit of some sort. Clearly, it would be
dangerous to use this data as part of SQL statements. However, I have
trouble imagining XSS exploit scenarios.

Thanks,

-Ben
Received on Oct 17 2004