AugusteBationo (Community Member) asked a question.
How do I use ajax to render a partiel view from my controller. Without having CWE 80: Cross-Site Scripting?
I read all the article I could find regarding this issue. But I could find find any with the answer to my question.
So here is what I'm trying to do. I have an action in my controller, when that action is called, through Ajax, I'm returning the view. I attached a sample. And you can see in the sample the Veracode error being detected: CWE 80: Cross-Site Scripting
.png){kind=logo}
Hi @AugusteBationo (Community Member),
Thanks for your question. I note that you appear to be making use of jQuery. The flaw has arisen due to the Veracode platform looking at this AJAX snippet in isolation and not trusting the response from the AJAX response. It is safest to assume that the data is untrusted, i.e. from a third-party API for example and apply cleansing operations to ensure no malicious payload such as a Cross-Site Scripting attack can execute.
If the data comes from a trusted origin then you may wish to propose a mitigation. To mitigate a flaw, refer to the following help article: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ. Alternatively remedial action may be required.
The current design makes this hard to achieve satisfactory cleansing as it is rendering raw HTML into the DOM. A safer design would be to instead return a JSON structure for example containing only the data to render, and to render that data into appropriate HTML specified in this function or via templating. This would allow you to cleanse each data field to ensure there is nothing malicious that could harm the end user. Templating would be the recommended approach to use as many common libraries perform cleaning operations on untrusted data.
If the codebase is legacy and not actively developed it may not be feasible to introduce templating, and so a whitelist approach of allowed characters should be used in combination with the HTML sanitisation features provided by jQuery as appropriate to restrict malicious input from affecting the DOM.
You may wish to make use of jQuery.parseHTML (https://api.jquery.com/jQuery.parseHTML/) if rendering DOM elements, however do note that whilst this function will not render script tags by default, it is still possible for malicious scripts to be executed, and the platform may still identify this flaw.
Thanks,
Anthony Fielding