I'm looking for a solution for CWE 159 in JavaScript code embedded in HTML code inside a JSP page like in the following example:

<script>

const id = '<%=org.owasp.encoder.Encode.forJavaScript(id)%>';

</script>

From the JavaDoc of OWASP's Encode.forJavaScript(String):

"Encodes for a JavaScript string. It is safe for use 

 in HTML script attributes (such as onclick), script 

 blocks, JSON files, and JavaScript source."

Despite the statement that this method should be safe for the context in which I use it, Veracode Static Analysis keeps flagging lines like the above with a CWE 159 issue. We have over 200 (!) such issues flagged by Veracode in our application. This is why I'm desperately looking for a solution. 

I have been testing various other cleansing methods from the official list published by Veracode. And it turns out that there is a method which seems to be accepted by Veracode for the above context: If I use Encode.forHtmlAttribute(String) instead of Encode.forJavaScript(String), Veracode does not complain anymore.

BUT ...

Encode.forHtmlAttribute(String) is NOT SAFE for this context. It does not encode newline characters or backslash characters. If those characters appear in the text but are not encoded, the resulting JavaScript code will become illegal.

My current working assumption is that the Veracode scan engine is not correctly detecting the context. It probably sees the leading and trailing quotes and then believes that this must be an HTML attribute value. This is why it accepts Encode.forHtmlAttribute(String) as a fix, but not Encode.forJavaScript(String) or Encode.forJavaScriptBlock(String).

Has someone experienced this as well? 

And if yes, have you found a solution for this problem?

Any help would be very appreciated!

Merry X-mas and a Happy New Year to everyone,

Stephan

PS: On request, I can provide a mini webapp (WAR file) which can be used to reproduce my scan results.