
Monir (Community Member) asked a question.
I am using the following C# code to set the <Key, Value> pairs which is later retrieved by .js and .cshtml code and display the values in the HTML5 page. Veracode static analysis is flagging the following lines highlighted in bold font as Improper Neutralization of Script-Related HTML Tags in a Web Page - CWE ID 80.
How can I fix this error?
public ActionResult Index()
{
string bankName = Url.RequestContext.RouteData.Values["bankname"].ToString();
ViewBag.Settings = new Dictionary<string, string>();
ViewBag.Settings.Add("Title", "Remote Deposit Plus");
ViewBag.Settings.Add("UseCompanyId", "false");
ViewBag.Settings.Add("AllowSplitDeposit", "true");
ViewBag.Settings.Add("AppRoot", Url.Content("~").TrimEnd('/'));
ViewBag.Settings.Add("bankname", bankName);
ViewBag.Settings.Add("PopulateHomeView", "false");
ViewBag.Settings.Add("BrandingCSSRoot", string.Format("~/Content/themes/branding/{0}/", bankName));
ViewBag.Settings.Add("Platform", string.Empty);
ReadSettings(bankName, ViewBag.Settings as Dictionary<string, string>);
ViewBag.Settings["Title"] = string.Format("{0}{1}", ViewBag.Settings["Title"], GetVersion());
return View();
}
Thanks.
.png)
Hi @Monir (Community Member) ,
That does look weird to me, I would recommend contacting Veracode Support.
You can contact Veracode Support by clicking your avatar in the top right corner and clicking "Contact Support". In your support case, please provide a URL to a scan on the Veracode Platform where you are experiencing this behaviour, as well as the corresponding flaw IDs.
Thank you,
Florian Walter