title: Reflected XSS on BufferedReader readLine() method
body: <p>I have scanned a java web project with the Checkmarx tool, and the analysis marks an XSS vulnerability in a method where a web service is executed that responds a JSON, the vulnerability is in the line <code>while((output = Encode.forJava(br.readLine())) != null) {</code>, specifically in <code>br.readLine()</code>.</p>
  <p>Checkmarx says:</p>
  <blockquote>
  <p>The attacker would be able to alter the returned web page by simply
  providing modified data in the user input <code>readLine</code>, which is read by
  the <code>NetClientPost</code> method. This input then flows through the code
  straight to the output web page, without sanitization.
  This can enable a Reflected Cross-Site Scripting (XSS) attack.</p>
  </blockquote>
  <p>I tried with OWASP for Java, implementing the method <code>Encode.forJava()</code>, but the vulnerability continues to appear in the analysis. This is the implementation of the method:</p>
  <pre><code>public String NetClientPost (String urlSer, String param){
          String result =&quot;&quot;;
          try {
              InetAddress ip = InetAddress.getLocalHost();
              String host = ip.getHostAddress();
              doTrustToCertificates();
              URL url = new URL(urlSer);
              HttpURLConnection conn = (HttpURLConnection) url.openConnection();
              conn.setDoOutput(true);
              conn.setRequestMethod(&quot;POST&quot;);
              conn.setRequestProperty(&quot;Content-Type&quot;, &quot;application/json&quot;);
              conn.setConnectTimeout(2000);
              String input = param;
              String output = &quot;&quot;;
  
              try(OutputStream os = conn.getOutputStream()) {
                  os.write(input.getBytes());
                  os.flush();
                  if (conn.getResponseCode() != 200) {
                      throw new RuntimeException(&quot;Failed : HTTP  code : &quot; + conn.getResponseCode());
                  }
                  
                  try (BufferedReader br = new BufferedReader(new InputStreamReader((conn.getInputStream())))) {
                      while ((output = Encode.forJava(br.readLine())) != null) {//LINE OF CHECKMARX XSS
                          result += output;
                      }
                  }
              }
              
              conn.disconnect();
              return result;
  
          } catch (MalformedURLException e) {
              return result;
          } catch (IOException e) {
              return result;
          } catch (Exception e) {
              return result;
          }
      }
  </code></pre>
  <p>Any have an idea of how to solve this?</p>