So we have the following JSP tag (minor changes for simplicity, hopefully I didn't introduce any typos):

<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>

<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>

<select id="${e:forHtmlAttribute(selectId)}" >

<c:forEach var="role" items="${roles}">

<c:choose>

<c:when test="${role.id eq selectedId or roles.size() eq 1}">

<c:set var="selected" value="selected"/>

</c:when>

<c:otherwise>

<c:set var="selected" value=""/>

</c:otherwise>

</c:choose>

<option

value="${e:forHtmlAttribute(role.id)}"

${selected}

title="${e:forHtmlAttribute(role.description)}"

>${e:forHtmlContent(role.description)}</option>

</c:forEach>

</select>

And without failure, the static analyzer flags the line with "${selected}" on it, indicating a CWE ID 80 on the line.

We have the same issue in a few other places with similar code, such as:

<option value="..." ${selectedId eq item.id ? 'selected' : ''} >

and these also get flagged (so at least there is consistency).

The scanner thinks that the tainted value from the DB (i.e. "role.id" or "item.id") is somehow part of the output, and thus a possible XSS issue. Now in the second example, I could see how maybe it could be confused -- after all, they are part of the same EL expression. However, in the first example, the generated Java code clearly outputs a static text string.

So, are we doing something wrong, or is this a bug in the static analyzer?