CCorley874897 (Community Member) asked a question.
How do I fix Veracode flaw CWE 80 in href javascript statement
CWE 80 flaw flagged in the following statement:
var childNode = rootNode.addChild({
title : data[i].title,
tooltip : "Click to expand.",
isFolder : data[i].isFolder,
isLazy : data[i].isLazy,
key : data[i].key,
href : data[i].href,
unselectable : true,
checkbox: false
});
href: data[i[].href.
How do I fix this?
.png){kind=logo}
Hi @CCorley874897 (Community Member) ,
Veracode Static Analysis reports flaws of CWE 80 Basic XSS in JavaScript if it can detect that data from outside of the JavaScript context. For example from the URL (window.location), from the document (document.forms) or from an XMLHttpRequest.
The concern being that if an attacker is able to use this source of outside data to change the href to something like "javascript:alert(document.cookie)" they can cause a user clicking the link to run their code.
The only remediation that Veracode Static Analysis is capable of automatically detecting is if the data is hardcoded.
If you are unable to hardcode the data please ensure it either originates from a trusted origin and/or you have validation only allowing specific paths that prevents an attacker from using this for XSS.
This will not be automatically detected by Veracode Static Analysis and you should then propose this a mitigation proposal ( https://help.veracode.com/go/improve_mitigation ) and reach out to your security team to request review.
Thank you,
Boy Baukema