Take the 2-minute tour ×

I have a Jersey app that has been run through our corporations website vulnerability tool. It came back with a vulnerability that is quite odd. If you send in this header:


You get an error message back in the BODY from jersey:

The HTTP header field "Accept" with value "*/*'"!@$^*\/:;.,?{}[]`~-_<sCrIpT>alert(56224)</sCrIpT>" could not be parsed.

This is not acceptable to our Security Team. It does come back as "text/plain" which is correct and all, but I need to change the message. Any way to do this?

This is running on Tomcat and I am using Jersey 1.14.

share|improve this question
Are you able to perform any success- or exception-checking when the Jersey resource returns? –  Jeff Gohlke Oct 4 '12 at 15:10
No. It doesn't even hit my code. Jersey tries to match the accept header to what I have set up and fails, AND they can't even parse the thing. So I don't see anything in my code. That is what makes this different than other posts on Stackoverflow... –  markthegrea Oct 4 '12 at 15:12
which app server is it running out of? –  amphibient Oct 4 '12 at 15:28
in addition to @foampile's request, please mention the jersey version as well. –  Yuval Adam Oct 4 '12 at 15:30
Are you using Apache as your web server? If this error message is associated with a unique URL you can specify a redirect rule in httpd.conf. I don't know how it would be done if you are using only Tomcat –  amphibient Oct 4 '12 at 15:50
add comment

1 Answer

up vote 2 down vote accepted

This is from Pavel on the Jersey team:

You should be able to purge the entity from your servlet filter, or you can register ContainerResponseFilter in Jersey, something like:

public class PurgeErrorEntityResponseFilter implements ContainerResponseFilter {
    public ContainerResponse filter(ContainerRequest request, ContainerResponse response) {
        if(response.getStatus() == 400) {
        return response;

and web.xml:


This worked for me. I did this:


and it escaped the error message. Thanks Pavel!

share|improve this answer
add comment

Your Answer


