SDeshpande103585 (Community Member) asked a question.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE ID
80)
80)
I am getting this for the below jsp code at line number 2 marked in bold letters.
document.getElementById('journalsRevTableId').innerHTML = '';
document.getElementById('journalsRevTableId').innerHTML=inhtlml;
jQuery("td.rspTdDataClass4").width(jQuery("th.rspThClass4").width());
jQuery("td.rspTdDataClass5").width(jQuery("th.rspThClass5").width());
jQuery("td.rspTdDataClass6").width(jQuery("th.rspThClass6").width());
getJournalDetailsData(batchNo, journalNo);
can any one please help me with this ?
.png){kind=logo}
Hi @SDeshpande103585 (Community Member),
Thanks for your question. If this is for an ID perhaps you want to use ".text" instead of ".innerHTML". Use ".text" to safely render untrusted data in such a way that it won't be interpreted incorrectly as HTML, thus removing the CWE-80 flaw.
Thanks,
Anthony Fielding
Thanks @Anthony Fielding, it worked
@Anthony Fielding (Veracode) : But how abt this kind of issues where only variable assignment is needed as below .
var errorMsg = '${scheduleBranchform.errorMsg}';
Hi @SDeshpande103585 (Community Member),
If Veracode is reporting a flaw around this then it will because scheduleBranchform and/or scheduleBranchform.errorMsg is considered untrusted. Likely the untrusted data has come from an AJAX request in many cases. Veracode would report any CWE 80 flaw at the point where this untrusted data is output without having first been suitably encoded/cleansed (i.e. via the use of ".text"). We would not report the flaw around the assignment. If that is the case you may wish to schedule a consultation using the pink button to discuss further.
Thanks,
Anthony
Can't we mark it as false positive?