CCorley874897 (Community Member) asked a question.
How do I fix CWE 80 flaw in jquery addclass()
Veracode scan has flagged multiple flaws in code similar to the following . The code highlights fields with errors returned in an Ajax call:
success: function(data)
{
if(data.successIndicator == 'failure'){
for ( var i = 0; i < data.fields.length; i++) {
$('#agent_' + data.fields[i]).addClass("error_style");
}
error_style in the css file:
.error_style {
border: solid;
border-width: 1px;
border-color: red;
}
The flaws are flagging lines with the .addClass() function call.
I tried replacing with .toggleClass but this also gets flagged as a flaw.
.png){kind=logo}
Hi @CCorley874897!
.addClass is a good practise for adding classes to HTML elements, good job!
I suspect this flaw is being flagged due to concatenating potentially tainted data to the JQuery selector.
$('#agent_' + data.fields[i])
In some versions of JQuery is it possible to create new HTML elements through the jQuery selector. For example, in vulnerable versions of jQuery, if you execute the below line it will popup with an alert. You can test this on your website using the developer tools within your browser and running the below command in the console.
$('<img src="https://www.veracode.com/themes/veracode/images/logo-veracode.svg" onload="alert(1)">')
This attack relies on having access to the full selector. In your case, as the prefix is hardcoded, you have mitigated against this kind of attack. Veracode won't be able to pick up this defence, so you will need to mitigate this. I would also be best practise to upgrade any 3rd party dependencies, such as JQuery, to a version without any know security weaknesses.
Hope that helps!
Seb