PKumar022351 (Community Member) asked a question.
I am using below ESAPI encoder code for print response XML, but still flaws has not gone from Veracode Scan Report. One place similar flaws resolve using same below code but one place is not resolve. Please assist me to resolve this issue.
PrintWriter out = response.getWriter();
out.println(ESAPI.encoder().encodeForXML(responseXML));
Hi @PKumar022351 (Community Member),
Thanks for your question. It appears as though your servlet is outputting XML data. If this is the case and you are also setting the correct ContentType header for XML e.g. "text/xml" or "application/xml" then you would be able to propose a mitigation since the output is XML and not HTML, and CWE-80 only applies to HTML.
If the output is HTML then the CWE-80 flaw would continue to be present. This is because encoding a Cross-Site Scripting (XSS) payload for XML would have no effect as for example "<script>alert('1')</script>" is valid XML. You may wish to consider using org.owasp.esapi.Encoder.encodeForHTML() or org.owasp.esapi.Encoder.encodeForHTMLAttribute() where appropriate instead. It is important to select the correct encoder suitable for the output medium.
I hope this answers your question.
Thanks,
Anthony Fielding
HI @Anthony Fielding (Veracode)
For org.owasp.esapi.Encoder.encodeForHTML() also I am getting same flaw Cross Site Scripting and
fix improper neutralization of script related html tags. Kindly help me with the fix.
PrintWriter out = response.getWriter();
out.print(StringEscapeUtils.unescapeHtml(Encode.forHtmlContent(responseStr)));
I even tried out.print(responseStr).
Still getting same flaws again and again.
Fast reply will be much helpful.
Hi @ASahu202858 (Community Member),
The use of unescapeHtml negates any security benefit from cleansing.
Instead of:
out.print(StringEscapeUtils.unescapeHtml(Encode.forHtmlContent(responseStr)));
consider using:
out.print(Encode.forHtml(responseStr));
I tried org.owasp.esapi.Encoder.encodeForHTML() as well other than Encode.forHTMLCOntent(), the encoding is required for us. Kindly help me to understand why Veracode flaw is pointing same flaw for no encoding as well. We are getting the content header and then body in response in html type
.png){kind=logo}
Hi @PKumar022351 (Community Member),
Thanks for your question. It appears as though your servlet is outputting XML data. If this is the case and you are also setting the correct ContentType header for XML e.g. "text/xml" or "application/xml" then you would be able to propose a mitigation since the output is XML and not HTML, and CWE-80 only applies to HTML.
If the output is HTML then the CWE-80 flaw would continue to be present. This is because encoding a Cross-Site Scripting (XSS) payload for XML would have no effect as for example "<script>alert('1')</script>" is valid XML. You may wish to consider using org.owasp.esapi.Encoder.encodeForHTML() or org.owasp.esapi.Encoder.encodeForHTMLAttribute() where appropriate instead. It is important to select the correct encoder suitable for the output medium.
I hope this answers your question.
Thanks,
Anthony Fielding