Monir (Community Member) asked a question.

How can I fix the CWE-ID 80 - Improper Neutralization of Script-Related HTML Tags in a Web Page flag in C# code?

I am using the following C# code to set the <Key, Value> pairs which is later retrieved by .js and .cshtml code and display the values in the HTML5 page. Veracode static analysis is flagging the following lines highlighted in bold font as Improper Neutralization of Script-Related HTML Tags in a Web Page - CWE ID 80.

 

How can I fix this error?

 

 public ActionResult Index()

   {         

     string bankName = Url.RequestContext.RouteData.Values["bankname"].ToString();

     ViewBag.Settings = new Dictionary<string, string>();

     ViewBag.Settings.Add("Title", "Remote Deposit Plus");

     ViewBag.Settings.Add("UseCompanyId", "false");

     ViewBag.Settings.Add("AllowSplitDeposit", "true");

     ViewBag.Settings.Add("AppRoot", Url.Content("~").TrimEnd('/'));

     ViewBag.Settings.Add("bankname", bankName);

     ViewBag.Settings.Add("PopulateHomeView", "false");

     ViewBag.Settings.Add("BrandingCSSRoot", string.Format("~/Content/themes/branding/{0}/", bankName));

     ViewBag.Settings.Add("Platform", string.Empty);

     ReadSettings(bankName, ViewBag.Settings as Dictionary<string, string>);

     ViewBag.Settings["Title"] = string.Format("{0}{1}", ViewBag.Settings["Title"], GetVersion());

     return View();

   }

 

Thanks.


  • Hi @Monir (Community Member)​ ,

     

    That does look weird to me, I would recommend contacting Veracode Support.

     

    You can contact Veracode Support by clicking your avatar in the top right corner and clicking "Contact Support". In your support case, please provide a URL to a scan on the Veracode Platform where you are experiencing this behaviour, as well as the corresponding flaw IDs.

     

    Thank you,

    Florian Walter

    Expand Post

Topics (1)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.