### Impact
There is a potential for an XSS vulnerability in ESAPI caused by a incorrect regular expression for “onsiteURL” in the **antisamy-esapi.xml** configuration file that can cause URLs with the “javascript:” scheme to NOT be sanitized. See the reference below for full details.

### Patches
Patched in ESAPI 2.3.0.0 and later. See important remediation details in the reference given below.

### Workarounds
Manually edit your **antisamy-esapi.xml** configuration files to change the “onsiteURL” regular expression as per remediation instructions in the reference below.

### References
[Security Bulletin 8](https://github.com/ESAPI/esapi-java-legacy/blob/develop/documentation/ESAPI-security-bulletin8.pdf)

### For more information
If you have any questions or comments about this advisory:
* Email one of the project co-leaders. See email addresses listed on the [OWASP ESAPI wiki](https://owasp.org/www-project-enterprise-security-api/) page, under “Leaders”.
* Send email to one of the two ESAPI related Google Groups listed under [Where to Find More Information on ESAPI](https://github.com/ESAPI/esapi-java-legacy#where-to-find-more-information-on-esapi) on our [README.md](https://github.com/ESAPI/esapi-java-legacy#readme) page.