kj1206 (Community Member) asked a question.
CWE 80 : how to fix the vulnerability in .append or .html in javascript/jquery
Got vulnerability in the line underlined for append(output). Here output is of type "html with link and script tags ". Tried sanitizing with DOMPurify but its breaking the functionality as DOMPurify.sanitize is changing the format of the output.
$.ajax({
type: 'Post',
url: url,
dataType: "html",
cache: false,
async: false,
success: function (output) {
$('#divID').append(output);
},
Could someone please suggest an alternative to fix that xss without changing the output. I cannot use textcontent or .text as the output has some link and style tags.
.png){kind=logo}
Hi @kj1206 (Community Member),
Great question! Using dynamic (potentially untrusted) data in an `append` is not a safe practice. If you must append to the DOM dynamically, we recommend that you use a JSON-based approach. In a nutshell, the idea is that you don't send HTML back and forth but a JSON document that describes how the dynamic part of the DOM should look like.
As an example, say you want to render a link using dynamic data. Instead of sending something like `<a href="some_url">blub</a>` back and forth (where encoding would break the logic), you could also send some JSON like this:
{
"element": {
"type": "a"
"attributes": {
"href": "some_url",
"link_text": "blub"
}
}
}
This JSON doesn't require any HTML and thus, you can apply encoding on its dynamic parts without breaking your logic. Once the encoded JSON reaches your JavaScript, you can render the corresponding HTML elements from it.
Thank you,
Florian Walter
Keep in mind that if you actually do need to show HTML content, such as an HTML email body, you will need to use an HTML sanitizer. In previous discussions with Veracode Security Consultants, we have discussed using a client-side sanitizer, which there are some (but they aren't super light), but we haven't yet used any in our product. We also use a server side sanitizer to help reduce (not eliminate) the chances of unsafe data coming to the client.
If you end up in this situation, I believe you will ultimately end up with no other choice than marking the flaw as "Mitigated; Accept the risk" as there are no listed cleansers supported by the Veracode Static Scanner for JavaScript HTML sanitization.
There are also some situations where the static scanner reports jQuery(), $(), .append, etc where there is no unsafe data being supplied (usually we see them as nested $() objects with attributes being set safely being passed to the append). While I need to go through our latest list with a Veracode Security Consultant to confirm, I believe there are various possibilities for false positives in this area.