Static Analysis Group (Archived) — KPonder104716 (Community Member) asked a question.
I am getting CWE ID 159 even though I am encoding with Encode.forHtml()
I am getting Failure to Sanitize Special Element CWE ID 159 on the following line
<input type="hidden" name="blazeColorsTaLayerId" value='<%=Encode.forHtml((String)request.getAttribute("blazeColorsTaLayerId")) %>'>
The example in the Encode API is <input value="<%=Encode.forHtml(unsafeData)%>" />. Can anyone tell me how I am using Encode.forHtml() incorrectly?
.png){kind=logo}
Hi,
Ideally for the values of attribute should be encoded using correct method. i.e. Encode.forHtmlAttribute. since the context here is the attribute and not the Html body.
Encoding is useful when we want to remediate CWE 80 (XSS issue.)
Can you please provide the Application scan link so I can see the flaw and advice accordingly.
Regards,
Kashif
By the Application scan link do you mean the link I click on to see the result of the scan? If so, is that something I should share on a public board? The scan is in my Sandbox, does that make a difference on sending you the Application scan link? I did change the forHtml() to forHtmlAttribute() which fixed the problem but the Encode API states
“In general this method (Encode.forHtml()) should be preferred (over Encode.forHtmlAttribute() and Encode.forHtmlContent()) unless you are really concerned with saving a few bytes or are writing a framework that utilizes this package.”
So it seems to me Encode.forHtml() should be accepted everywhere Encode.forHtmlAttribute() or Encode.forHtmlContent() is accepted.
Hi,
With regards to CWE 159, developers should anticipate that special elements for e.g. Request.getAttribute in this context will be injected or manipulated in the input vectors of their application. Use an appropriate combination of black lists and white lists to ensure only valid, expected and appropriate input is processed by the system.
It is advisable to have null checks in place before typecasting to String and passing to the Encode method to ensure safe behavior of the code
I would advise you set up Consultation or write email to support@veracode,com by giving details of the scan (Link of scan) & flaw ids .
Regards,
Kashif Syed
Hi @KPonder104716 (Community Member) - as follow-up on @Kashif, Security Consultant (Veracode inc)'s comment, you can check out this knowledge article on how to schedule a consultation call with us.
I sent an email to support and they said it was a known issue and no ETA on when it is going to be fixed. It isn't a big deal to have to use forHtmlAttribute() instead of forHtml().
Thanks @KPonder104716 (Community Member) for the update! Could you keep the Community posted as you make progress on the support case?