AGadre146415 (Community Member) asked a question.

January 28, 2020 at 9:56 AM
Need guidance for CWE ID - 80 : Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Hi,

 

We have a functionality in which application receives an http response and writes it into an html page. Purpose is to display a report in html format. Following is the code -

BufferedReader bufreader = new BufferedReader(new InputStreamReader(resp.getEntity().getContent()));

try (OutputStreamWriter outputStream = new OutputStreamWriter(response.getOutputStream())) {

while ((lineItem = bufreader.readLine())!=null) {

outStream.write(lineItem); }

 

For line outStream.write(lineItem), Veracode has reported issue - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).

 

What will the right approach to fix this issue?

 

Thanks,

Amit

  • 1 answer
  • 3.89K views

  • Boy, Security Consultant (Veracode)

    Hi @AGadre146415 (Community Member)​ ,

     

    Veracode Static Analysis reports flaws of CWE 80  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) when it detects data going out of the application ( outStream.write in this example ) when that data is coming from an outside source like an HTTP request, but also from the database, a file or a webservice response and it does not pass through one of our Supported Cleansing Functions ( https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA ). In this case the data appears to be 'resp.getEntity().getContent()' which may be a webservice response?

     

    The concern is that if part of that data originates from a user any special characters like "<script>" may not have been sanitized and this may allow attackers to inject their own script into your pages.

     

    Typically we recommend that you verify that you are outputting HTML. If you are setting a Content-Type header with a different content type than HTML or XML like for example "application/pdf" you may not be vulnerable (no way to cause XSS in PDF output) but Veracode Static Analysis may not be able to detect it. If this is so you will need to propose a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and contact your security team for mitigation review.

     

    Alternatively if you're outputting stored HTML from some trusted source (an administrator controlled HTML snippet stored in the database for example) you may not be vulnerable but Veracode Static Analysis may not be able to detect it. If this is so you will need to propose a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and contact your security team for mitigation review.

     

    These issues can get very complex depending on the origin of the data and how much of it is user controlled. To help investigate the potential risk and the possible remediation or mitigation strategies you can schedule a consultation with a Veracode Application Security Consultant like me or my colleagues. You can find more information on how to do this here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ .

     

    Thank you,

    Boy Baukema

    Expand Post
    Selected as Best

  • Boy, Security Consultant (Veracode)

    Hi @AGadre146415 (Community Member)​ ,

     

    Veracode Static Analysis reports flaws of CWE 80  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) when it detects data going out of the application ( outStream.write in this example ) when that data is coming from an outside source like an HTTP request, but also from the database, a file or a webservice response and it does not pass through one of our Supported Cleansing Functions ( https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/IiF_rOE79ANbwnZwreSPGA ). In this case the data appears to be 'resp.getEntity().getContent()' which may be a webservice response?

     

    The concern is that if part of that data originates from a user any special characters like "<script>" may not have been sanitized and this may allow attackers to inject their own script into your pages.

     

    Typically we recommend that you verify that you are outputting HTML. If you are setting a Content-Type header with a different content type than HTML or XML like for example "application/pdf" you may not be vulnerable (no way to cause XSS in PDF output) but Veracode Static Analysis may not be able to detect it. If this is so you will need to propose a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and contact your security team for mitigation review.

     

    Alternatively if you're outputting stored HTML from some trusted source (an administrator controlled HTML snippet stored in the database for example) you may not be vulnerable but Veracode Static Analysis may not be able to detect it. If this is so you will need to propose a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and contact your security team for mitigation review.

     

    These issues can get very complex depending on the origin of the data and how much of it is user controlled. To help investigate the potential risk and the possible remediation or mitigation strategies you can schedule a consultation with a Veracode Application Security Consultant like me or my colleagues. You can find more information on how to do this here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ .

     

    Thank you,

    Boy Baukema

    Expand Post
    Selected as Best

Topics (4)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.