Hi @PKumar022351 (Community Member)​ ,

The primary defence against CWE 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) is correctly contextually HTML encoding using one of our Supported Cleansing Functions: https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA .

ESAPI.encoder().encodeForHTML is one of our supported cleansing functions and if applied correctly and consistently should get the flaw automatically closed.

However, you can only encode at the point where the general variable data becomes HTML. If you encode the data too early you may not be encoding all data.

So in your example you might want to use something like:

out.println(

"<td width=\"60%\">"+ ESAPI.encoder().encodeForHTML(optGen.fillHerUp( Organization, industryType, strROVValue, !isUpdateOnBehalfOfSelf) ) +"</td>");

Unfortunately, determining where you should be encoding depends very much on where you are adding HTML and the design of your application. If you have any questions on this I would recommend scheduling a Consultation with a Veracode Application Security Consultant. You can find more on how to do this here: https://help.veracode.com/reader/_xqy2rBkFBfaxzuiNu~wsg/kAO0UeevRvOPnidK6_e5IA .

Thank you,

Boy Baukema

@Boy, Security Consultant (Veracode)​

I used DOMPurify in the past to sanitize the HTML input and Veracode was able to mark the CWE-80 as fixed. However, Veracode recently re-marked my code as vulnerable, although I'm still using the COMPurify and did not do any code change on that part.

Btw, the above links are redirecting me to a "404 - Not Found" page. Did anything change on Veracode's size that changed how it's marking code as vulnerable or fixed?