Srinubabu (Community Member) asked a question.
Veracode Scan: jQuery html method showing Improper Neutralization of Script-Related HTML Tags in a Web Page issue
Veracode is pointing out the issue Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in the below line.
$('#SummaryDiv').html(data);
I am binding the MVC View Result to DIV via the ajax call. Checked the articles in the veracode community but no luck. What could be the possible solution to fix this veracode issue.
.png){kind=logo}
Hi @Srinubabu (Community Member) ,
Veracode Static Analysis will report a flaw of CWE 80 Basic XSS if it can detect that the jQuery .html method is used with data from outside of the JavaScript content, like the URL, data from the DOM or from an XmlHTTPRequest.
The concern is that if that data can be manipulated by an attacker they could inject their own HTML like for example <script> tags that run arbitrary code on the page.
We typically recommend switching to the .text method to ensure no HTML can be injected.
If this is not possible as this is trusted HTML from your own server you will need to propose a mitigation, you can see more on how to do this here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ .
Thank you,
Boy Baukema
Thank you @Boy, Security Consultant (Veracode) for your response. After considering all of the information from veracode community I have get it fixed with the following information.
DOM based XSS Prevention Cheat Sheet
https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.md
OWASP Enterprise Security API (ESAPI)
https://github.com/ESAPI/owasp-esapi-js/blob/28b2767731e672c620b86701a9f98f235951392b/README.md
ESAPI method to encode un-trusted content: $ESAPI.encoder().encodeForHTML(content)
Thank you for replying @Srinubabu (Community Member) .
I do want to clarify that while Veracode Static Analysis may no longer be able to detect tainted data after the encodeForHtml method is applied this does not mean it is a supported cleansing function or has been vetted by Veracode Research.
I would like to caution that it appears ESAPI4JS has been abandoned and would like to suggest using jQuerys .text method instead: https://api.jquery.com/text/#text2 .
This relies on the browser encoding the data instead of having its own encoding mechanism so should be much harder to bypass.
Thank you,
Boy Baukema
@Boy, Security Consultant (Veracode) yeah I am utilising text method as well post encoding. I am no longer using the .html method.