> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/ocular/tutorials/ocular-jsp.md).
# Investigate a Java Server Pages Application
You can use Ocular to examine the software elements and flows in your JSP application, to identify complex business logic vulnerabilities that can't be scanned for automatically. Note that this support does *not* include JSP Expression Language.
This tutorial illustrates the use of Ocular with JSP, based on the [Java Vulnerable Lab](https://github.com/CSPF-Founder/JavaVulnerableLab) sample project.
## Getting Started
Start Ocular by running `sl ocular`.
Create the Code Property Graph (CPG) and Security Profile (SP), and then query for findings:
```
importCode("JavaVulnerableLab.war")
run.securityprofile
cpg.finding.p
```
 
The `findings` query returns a comprehensive list of findings, each with its own title, score, description and associated vulnerable flow:
```
-------------------------------------
Title: SQL Injection: HTTP data to SQL database via `request`
Score: 9
Categories: [a1-injection]
Flow ids: [9212286253158463995]
Description: HTTP data is used in a SQL query without undergoing escaping or validation. This could allow an attacker to read sensitive data from the database, modify its content or gain control over the server.
```
 
## Countermeasures
The identified vulnerabilities can be prevented by using prepared statements on the HTTP data.
```
-------------------------------------
_________________________________________________________________________________________________________________________
| tracked | lineNumber| method | file |
|========================================================================================================================|
| request | 103 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| request | 266 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| this | N/A | getParameter | javax/servlet/http/HttpServletRequest.java |
| ret | N/A | getParameter | javax/servlet/http/HttpServletRequest.java |
| request.getParameter("user")| 266 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| param1 | N/A | .assignment| N/A |
| param0 | N/A | .assignment| N/A |
| user | 266 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| user | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| param0 | N/A | append | java/lang/StringBuilder.java |
| ret | N/A | append | java/lang/StringBuilder.java |
| $r33.append(user) | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| param1 | N/A | .assignment| N/A |
| param0 | N/A | .assignment| N/A |
| $r34 | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| $r34 | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| this | N/A | append | java/lang/StringBuilder.java |
| ret | N/A | append | java/lang/StringBuilder.java |
| $r34.append("\'") | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| param1 | N/A | .assignment| N/A |
| param0 | N/A | .assignment| N/A |
| $r35 | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| $r35 | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| this | N/A | toString | java/lang/StringBuilder.java |
| ret | N/A | toString | java/lang/StringBuilder.java |
| $r35.toString() | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| param1 | N/A | .assignment| N/A |
| param0 | N/A | .assignment| N/A |
| $r36 | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| $r36 | 267 | _jspService | io/shiftleft/precompiledjsp/admin/manageusers_jsp.java|
| param0 | N/A | executeUpdate | java/sql/Statement.java
```
 
## Identifying the Vulnerable Flow Through JSP
In the flow associated with the vulnerability, the call starts from `io/shiftleft/precompiledjsp/admin/manageusers_jsp.java`, which is essentially a precompiled JSP created by Ocular as part of the process of generating the CPG. The JSP is derived from the [webapp/admin/manageusers.jsp file](https://github.com/CSPF-Founder/JavaVulnerableLab/blob/master/src/main/webapp/admin/manageusers.jsp).
All precompiled files are part of the `io.shiftleft.precompiledjsp` namespace. This is one way to identify and audit JSP-only methods while investigating data flows using Ocular. For example, the following query lists the methods that are part of the precompiled JSP from Java Vulnerable Lab
```
cpg.namespace.name("io.shiftleft.precompiledjsp.vulnerability.sqli").method.fullName.l
```
 
Please note that currently the line numbers don't correspond to the actual lines in the JSP files, since the information is derived from compiled Java files.