MSkidmore454594 (Community Member) asked a question.
Will Veracode recognize the .NET Supported Cleansing function antixsslibrary_dll.Microsoft.Security.Application.AntiXss.GetSafeHtmlFragment for other than CWE IDs 80, 93, 113, and 117?
I've implemented Sanitizer.GetSafeHtmlFragment() around an exception message in a CWE ID 209 flaw but Veracode is still reporting the flaw.
.png){kind=logo}
Hi @MSkidmore454594 (Community Member) ,
CWE-209 relates to sensitive data and as such is not something that can be cleansed in the sense that an expliotable XSS flaw can be. In general, one should avoid putting the sensitive information in user-facing output.
More information can be found in this article: https://www.veracode.com/security/java/cwe-209
Best regards,
Duncan