SBoova646688 (Community Member) asked a question.
Why is setting a textbox value to a value from a parameterized database query flagged as CWE 80
see below, line 83 and 87
Dim oReader As SqlDataReader = SqlHelper.ExecuteReader(Connection, CommandType.Text, sQuery.ToString(), arParams)
80
81
If oReader.Read Then
82
If Not IsDBNull(oReader("CompanyName")) Then
83
txtCompany.Text = oReader("CompanyName").ToString()
84
End If
85
86
If Not IsDBNull(oReader("OrganizationGroupName")) Then
87
txtOrgGroup.Text = oReader("OrganizationGroupName").ToString()
88
End If
89
End If
.png){kind=logo}
Hi @SBoova646688 (Community Member) ,
Veracode Static Analysis reports flaws of CWE 80 when it can see data from a potentially untrusted source (such as a HTTP request, but also a file, database result or session) going into a Label.Text property.
The concern is that if an attacker can insert HTML into this data they will be able to display this on your web pages causing an XSS or Cross-Site-Scripting vulnerability ( https://en.wikipedia.org/wiki/Cross-site_scripting ).
We recommend using one of our supported cleansing functions from our list at https://help.veracode.com/r/review_cleansers to HTML encode any data going into a .Text property.
Veracode Static Analysis will be able to automatically recognize it's use (if used appropriately) and will automatically close this flaw upon making the change, rebuilding and resubmitting for analysis.
Thank you,
Boy Baukema