From c5808569df4e8dd29259450ad5a36bf5f3119765 Mon Sep 17 00:00:00 2001
From: snow <snow@snows-MacBook-Pro-2.local>
Date: Sun, 9 Aug 2026 17:52:48 -0700
Subject: [PATCH] Escape reflected XSS image src level 1

Signed-off-by: snow <snow@snows-MacBook-Pro-2.local>
---
 .../vulnerability/xss/reflected/XSSInImgTagAttribute.java  | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
index 0fb172153..b4cd45882 100644
--- a/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
+++ b/src/main/java/org/sasanlabs/service/vulnerability/xss/reflected/XSSInImgTagAttribute.java
@@ -50,10 +50,13 @@ public XSSInImgTagAttribute() {
     public ResponseEntity<String> getVulnerablePayloadLevel1(
             @RequestParam(PARAMETER_NAME) String imageLocation) {
 
-        String vulnerablePayloadWithPlaceHolder = "<img src=%s width=\"400\" height=\"300\"/>";
+        String vulnerablePayloadWithPlaceHolder = "<img src=\"%s\" width=\"400\" height=\"300\"/>";
 
         return new ResponseEntity<>(
-                String.format(vulnerablePayloadWithPlaceHolder, imageLocation), HttpStatus.OK);
+                String.format(
+                        vulnerablePayloadWithPlaceHolder,
+                        StringEscapeUtils.escapeHtml4(imageLocation)),
+                HttpStatus.OK);
     }
 
     // Adding Untrusted Data into Src tag between quotes is beneficial but not