From 51b57eb3eaa2cae580df6a236009c54ccbc7f9be Mon Sep 17 00:00:00 2001
From: snow <snow@snows-MacBook-Pro-2.local>
Date: Sun, 9 Aug 2026 17:44:33 -0700
Subject: [PATCH] Escape reflected XSS HTML tag level 1

Signed-off-by: snow <snow@snows-MacBook-Pro-2.local>
---
 .../vulnerability/xss/reflected/XSSWithHtmlTagInjection.java | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java
index 413b1cc5b..1e2d58589 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSWithHtmlTagInjection.java
@@ -35,10 +35,11 @@ public class XSSWithHtmlTagInjection {
     @VulnerableAppRequestMapping(value = LevelConstants.LEVEL_1, htmlTemplate = "LEVEL_1/XSS")
     public ResponseEntity<String> getVulnerablePayloadLevel1(
             @RequestParam Map<String, String> queryParams) {
-        String vulnerablePayloadWithPlaceHolder = "<div>%s<div>";
+        String vulnerablePayloadWithPlaceHolder = "<div>%s</div>";
         StringBuilder payload = new StringBuilder();
         for (Map.Entry<String, String> map : queryParams.entrySet()) {
-            payload.append(String.format(vulnerablePayloadWithPlaceHolder, map.getValue()));
+            String escapedValue = StringEscapeUtils.escapeHtml4(map.getValue());
+            payload.append(String.format(vulnerablePayloadWithPlaceHolder, escapedValue));
         }
         return new ResponseEntity<String>(payload.toString(), HttpStatus.OK);
     }