RProsalik276985 (Community Member) asked a question.
CWE ID 80 Issue with Python Flask API
I have a small Python Flask API where each one of my return statements has been flagged with "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE ID 80)". Sample python code leading up to the flagged return of the response is:
content = request.get_json()
rtnmsg =
some_function(content)
response = jsonify(rtnmsg)
response.mimetype = 'application/json'
response.status_code = 400
return response
My presumption is the flask
request.get_json() does the sanitation of special characters and json
validation? What should be done additionally to satisfy the CWE ID 80 flagging
of this code?
.png){kind=logo}
Hi @RProsalik276985 (Community Member)
Refer https://flask.palletsprojects.com/en/1.1.x/api/#flask.Response.get_json for official documentation of get_json() of the Flask API.
You can use is_json property to validate that the data returned is indeed Json string.
If it taken care of, I would recommend you to raise Mitigation by design.
If you have any questions on this I would recommend scheduling a Consultation with a Veracode Application Security Consultant. You can find more on how to do this here: https://help.veracode.com/reader/_xqy2rBkFBfaxzuiNu~wsg/kAO0UeevRvOPnidK6_e5IA .
Regards,
Kashifali