SBoova646688 (Community Member) asked a question.
Code Example 1:
If DataReader.Read Then
64
If Not IsDBNull(DataReader("FileName")) AndAlso Not IsDBNull(DataReader("BinaryData")) Then
65
Response.AppendHeader("content-disposition", "attachment; filename=" + DataReader("FileName").ToString())
66
Response.ContentType = "application/octet-stream"
67
Response.BinaryWrite(CType(DataReader("BinaryData"), Byte()))
68
End If
69
End If
Code Example 2:
Using cmd As New SqlCommand("usp_SMUReports_Plants_Web_AllConcreteOrSteel_XML", cn)
32
cmd.CommandType = CommandType.StoredProcedure
33
cmd.Parameters.AddWithValue("@IsSteelUser", Session("IsSteelUser"))
34
cmd.Parameters.AddWithValue("@IsConcreteUser", Session("IsConcreteUser"))
35
cmd.Parameters.AddWithValue("@DistrictNumber", Session("DistrictNumber"))
36
cmd.Parameters.AddWithValue("@UserID", Session("UserID"))
37
cmd.Parameters.AddWithValue("@ConcreteOrSteel", "Concrete")
38
Dim dr As SqlDataReader = cmd.ExecuteReader
39
While dr.Read
40
s &= dr(0).ToString
41
End While
42
End Using
43
End Using
44
Response.Clear()
45
Response.ContentType = "application/xml; charset=utf-8"
46
Response.Write(s)
47
Response.Flush()
48
Response.Close()
.png){kind=logo}
Veracode Static Analysis detects CWE 80 Basic XSS when it can see data from outside of the application going into an HTTP Response. The concern is that if an attacker can control this external data they might embed their own HTML or JavaScript and steal user data.
Veracode Static Analysis currently does not currently automatically detect use of a Content-Type or Content-Disposition header as remediation for CWE 80. However, correctly used, these do prevent browsers from rendering the provided content as HTML on the same domain. To request this be supported please consider registering your idea at: https://community.veracode.com/s/ideas .
Until such time we recommend documenting that this is in place by proposing a mitigation ( https://help.veracode.com/r/improve_mitigation ) and having this manually reviewed by a member of your organizations security team (note that they do not get an automatic message and you will need to contact them to request a review).
Thank you,
Boy Baukema