RRoy Moulick393155 (Community Member) asked a question.
How to fix CWE 80 issue in JAVA code
I got veracode cwe 80 issue for a string xml large response in my code. As per veracode the tainted data originated from an earlier call to java.net.URLConnection.getInputStream, which is used to fetch the xml response. To fix this I have applied both the ESAPI xml encoder and Encode.forXml() in my output response. But this methods have changed my xml output. Actually special characters present in my xml output have been changed to <, >, :, = etc. Could anybody please help me on this so that I can remove this from next veracode static scan report as well as get actual xml response.
Thanks in advance.
.png){kind=logo}
Hi @RRoy Moulick393155 (Community Member),
Thanks for your question. If you are outputting XML and not HTML then perhaps from the sounds of it, encoding as HTML is not desired. If this is the case, be sure you specify the correct (and non-HTML) Content-Type in the HTTP response header e.g. "application/xml". An example code snippet would be to use response.setContentType("application/xml; charset=utf-8"). It is also a good idea to set a Content-Disposition HTTP response header to request the browser only present the file for downloading and not to attempt to render it should a user request this resource using a web browser. This can be achieved using the following code example: response.setHeader("Content-Disposition", "attachment");. Additional reference can be found here: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#rule-31-html-encode-json-values-in-an-html-context-and-read-the-data-with-jsonparse.
After setting both the Content-Type and Content-Disposition HTTP response headers, I would recommend you propose a Mitigation By Design and mention these headers as controls that mitigate the CWE-80 flaw, also be sure to mention that the data is not HTML if that is the case. You can learn how to propose a mitigation if you haven't done this before here: https://help.veracode.com/r/improve_mitigation?section=mitigate__propose.
If instead it is desired to present this XML data as HTML, it should be correctly HTML-encoded using one of the recommended cleansers which you can find here: https://help.veracode.com/r/review_cleansers.
I hope that answers your question.
Thanks,
Anthony Fielding