RRoy Moulick393155 (Community Member) asked a question.
I am getting cwe 80 issue while trying to fetch http servlet response(application/xml) from my java rest service. I have applied ESAPI.encoder().encodeForXml in my response. After doing this issue has been disappeared from veracode but I am getting wrong response. All the special characters in my xml response like <,/,> etc. have been changed to <,> etc. Due to this I have applied StringEscapeUtils.unescapexml(responsexml) in the next statement of ESAPI encoder applied statement to make veracode fool, but no luck. After this change issue is again appeared in veracode but I am getting my actual xml response. Can anybody please advise me some way/approach for java code so that I can make veracode clean as well as get desired xml result.
.png){kind=logo}
Hi @RRoy Moulick393155 (Community Member) ,
Veracode Static Analysis reports a flaw of CWE 80 Basic XSS when I can see that there is data from outside of the application (like from an HTTP Request, but also from a file or database read) going into something typically used for an HTTP Response like a JSP template or an OutputBuffer without having passed through a Supported Cleansing Function .
It's difficult to give a recommendation without knowing more details of your situation but typically we do recommend using a cleansing function, as you have done.
However, if after applying the cleansing function you find that required characters have been encoded then you need to move the encoding earlier. Encoding should be done at the moment dynamic data (like a username) is placed inside XML syntax, for example:
// WRONG, will encode XML:
XML = '<tag>' + username + '</tag>';
XML = encode( XML );
// RIGHT, will only encode dynamic data:
XML = '<tag>' + encode( username ) + '</tag>';
Note that this may not always be possible. You may be for example be loading trusted XML documents from disk and outputting that to a response. In this case, Veracode Static Analysis would not be able to discern that the file being loaded is from an administrator managed location and would report it as a flaw.
If this is the case, we recommend documenting this in a Mitigation Proposal and having this proposal reviewed by your security team.
Please note that, while preferred, it is not always possible or even desirable to implement something that Veracode Static Analysis will automatically be able to detect and mitigation proposals are a normal part of remediation.
If you have any other questions, I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema
Thank you Boy, Baukema!!! In my code the http servlet request is final(i.e., constant in JAVA). So, should I need to change anything else in my code or I can propose it for mitigation in Veracode.
Regards,
Ritesh
Happy to help @RRoy Moulick393155 (Community Member) .
Unfortunately, I can't see without knowing more about your specific flaw. Having the request as a 'final' variable doesn't typically impact the security of the application though.
Typically if you have these types of questions I'd recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us, this way you get access to our entire team of consultants, typically this is included in what your company purchased.
For this specific flaw, in this specific case, please feel free to send me an email ( at bbaukema on the veracode.com domain). In it please include a link to the relevant results in the Veracode Platform (starts with https://analysiscenter.veracode.com/...) and the ID of the flaw and I'm happy to take a quick look.
Thank you,
Boy Baukema