title: how to stop XSS from non string parameter
body: <p>I have an old legacy application at work I was assigned to fix its security vulnerabilities. We did an application assessment scan on it which showed XSS vulnerabilities. I was able to mitigate a lot of the form input by sanitizing it using a jsoup whitelist. Looking through the report I have a few areas where it was able to inject a numerical value into a long type parameter.</p>
  
  <p>Here is the findings message:</p>
  
  <p>The following changes were applied to the original request: Injected <code>'622";alert(240)'</code> into the value of parameter <code>'name_id'</code></p>
  
  <p>Reasoning: The test result seems to indicate a vulnerability because the application successfully embedded a script in the response, which will be executed when the page loads in the user's browser.</p>
  
  <pre><code>Request/Response: GET /applicationName/name.jsp? name_id=622";alert(240)
  </code></pre>
  
  <p>The application is written in JSP/javascript for its presentation layer, and gets parameter values by calling the getParameter on the HttpRequestContext class.</p>
  
  <p>Here is how the code receives the parameter value:</p>
  
  <pre><code>long nameID = request.getParameter("name_id", 0L);
  </code></pre>
  
  <p>How is a long type value being changed? Is it through the URL? If so how can this be mitigated or prevented?</p>
  
  <p>if name_id is assigned to a long type variable in the code, how can: <code>"name_id=622";alert(240)"</code> be injected to it?</p>