Hi @Catalin (Community Member)​ 

Are you able to safely provide some sample code snippets or pesudo code? I haven't got enough details to provide a more in-depth answer.

I wouldn't expect a string composed of hardcoded and HTMLEncoded elements to flag as XSS. Are you using a supported cleanser when encoding the strings? HTML encoding is the key to avoid XSS and it sounds like you are on the right path. The flaw description or the data path within the Veracode platform may also provide some more additional details.

If, with discussion with your security team, you feel there is no risk then you also have the option of following the mitigation workflow.

Thanks, Seb

Hello Seb,

Thank you for your reply. Unfortunately, I am not allowed to set this issue as mitigated (one of the reasons, we have many places in the code where this specific pattern is being used and being flagged as issue by the scanner). So I am being forced to find an actual solution for it.

In the meantime I managed to speak with a Veracode engineer who said that there may be a bug in the Veracode scanner, and that he will create a ticket. No ticket yet. Nonetheless, I am posting a sample code here so you can see what I am talking about.

string s = String.Format( HTML.HtmlEncode(@"Trade {0} for "), HTML.HtmlEncode(TradeUtilities.TradeNumberFull(row[TradeConstants.TRADE_NUMBER_KEY], row[TradeConstants.CHILD_TRADE_NUMBER_KEY])));

DataTable tblSiblingFacilitiesFiltered = Utilities.Table_copy(SiblingFacilities, string.Format ("iDealID = {0}", Utilities.ObjToInt(row["id"])));

for (int i = 0; i < tblSiblingFacilitiesFiltered.Table.Rows.Count; i++)

{

 if (i != 0)

 {

   s += ", ";

 }

 s += HTML.HtmlEncode(tblSiblingFacilitiesFiltered.Rows[i]["sFacilityName"]); <- if I comment out this line, this code will pass the scan

}

lnkBulkActionTrade.Text = s; <- this line fails the scan if I leave the line above in the code

HTML.HtmlEncode is just a wrapper for AntiXssEncoder.HtmlEncode (recognized cleanser by Veracode), as follows:

public static string HtmlEncode(object value)

{

 if (value != null)

 {

   if (value is string)

   {

     // AntiXssEncoder.HtmlEncode does encode the newlines, and I haven't found a way to stop that

     string s1 = AntiXssEncoder.HtmlEncode((string)value, true).Replace("&#13;&#10;", Environment.NewLine);

     return s1;

   }

   else if (!(value is System.DBNull))

   {

     string s2 = AntiXssEncoder.HtmlEncode(value.ToString(), true);

     return s2;

   }

 }

 return null;

}

Hi @Catalin (Community Member)​ !

I suspect that the further manipulation of a string after it has passed through a cleanser is what is causing the issue. In this first instance (although I know it will break your requirement for newlines) I would try and remove this section

.Replace("&#13;&#10;", Environment.NewLine);

And rescan, see if the scanner behaves differently. If this is the case then it is this further manipulation of the string that is causing the "cleansing" to be broken. The scanner wouldn't be able dictate as to whether that further manipulation of the string is safe. We do not have any supported cleansers that will not encode newline characters because they are part of another attack (CRLF injections). The only way forward would be a mitigation and I would recommend looking at custom cleansers

IF the flaw is still flagged even after removing ".Replace("&#13;&#10;", Environment.NewLine);" then it would look more like a bug to me. There is an active bug being looked at when Encoding and another action is performed on the same line in Java Spring, I didn't think it affected .NET but a quick way to test is to break this up so only x1 function is called a time;

string s1 = (string)value;

s1 = AntiXssEncoder.HtmlEncode(, true);

s1 = s1.Replace("&#13;&#10;", Environment.NewLine);

return s1;

The mitigation process however is there so that teams do not need to spend effort refactoring to satisfy a scanner if the risk is within the organisations tolerance. If you have an ASC support package, it may be worth scheduling a consultation call to discuss with your security team.

You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

Thanks! Seb

Hi @Catalin (Community Member)​ !

Sorry another thought - instead of trying to encode/decode the new lines, why not split and rejoin the sections? This would allow you to keep the full cleansing power of AntiXSS and still satisfy the new line requirement.

For Example (pesudocode)

// Split on new line

string[] arrayOfValues = tblSiblingFacilitiesFiltered.Rows[i]["sFacilityName"].Split("\\n")

// Encode sections

for(var i = 0; i < arrayOfValues .Length; i++)

arrayOfValues [i] = HTML.HtmlEncode(arrayOfValues [i])

// rejoin with newlines

var joined = String.Join(",\\n" arrayOfValues);

Just another option. You could also do this in your HtmlEncode helper class

Thanks Seb