kj1206 (Community Member) asked a question.
CWE ID 80 : How to fix the vulnerability for Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
For the below function veracode report is showing vulnerability for the underlined lines of code.
function DropDown(element, data, overwrite) {
var optionLabel;
if ($(element).find("option[value='']") != null && $(element).find("option[value='']") != 'undefined') {
optionLabel = $(element).find("option[value='']").html();
}
var hasValue = false;
var value = $(element).val();
I am assuming it is because of the element. Could someone please guide me in mitigating the flaw.
.png){kind=logo}
Hi @kj1206 (Community Member),
Great question! Veracode Static Analysis does not support any JavaScript cleansing function at the moment. We generally recommend using text() instead of html() to update the DOM whenever possible. Also, we recommend using $.parseHTML(someHtml, null, false).find(...) rather than $(someHtml).find(...) as it parses with a null context (ensuring inline events won't be executed during parsing) and removes scripts (3rd parameter, default to false).
Thank you,
Florian Walter