VAYYADURAI218897 (Community Member) asked a question.
We get CWE ID 80 flaw and the details below and we get this when bind data at user control. The data is passed from parent page.
We get value from query string and that value is used to get data object through stored procedure and the data object we store it in context and used across other user controls.
Let us know how to fix this issue "The tainted data originated from an earlier call to system_data_dll.System.Data.Common.DbDataAdapter.Fill.".
We have validated data before passing it to stored procedure to create data object.
Attack Vector: system_web_dll.System.Web.UI.WebControls.Label.set_Text
Number of Modules Affected: 1
Description: This call to system_web_dll.System.Web.UI.WebControls.Label.set_Text() contains a cross-site scripting (XSS) flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis. The first argument to set_Text() contains tainted data. The tainted data originated from an earlier call to system_data_dll.System.Data.Common.DbDataAdapter.Fill.
.png){kind=logo}
Hi @VAYYADURAI218897 (Community Member) ,
In ASP.NET Label controls don't automatically encode their input for HTML so you should replace something like:
UserNameLabel.Text = Row["username"];
By something like:
UserNameLabel.Text = Server.HtmlEncode(Row["username"]);
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema