Hi @KZhou820937 (Community Member)​ ,

Unfortunately, there are no functions in widely distributed runtimes or libraries that we currently recognize.

If you have any suggestions for supported cleansing functions please submit them to https://community.veracode.com/s/ideas .

Veracode Static Analysis does automatically detect proper use of Text nodes ( https://developer.mozilla.org/en-US/docs/Web/API/Document/createTextNode ) and will close any flaw where user input is only placed in a Text node. As such, we frequently recommend use of this functionality with something like the following:

// jQuery version:

function escapeHtml(value) {

   const p = document.createElement('p');

   $(p).text(value);

   return $(p).html();

}

// Standards version (may not work in legacy browsers):

function escapeHtml(value) {

var text = document.createTextNode(value);

var p = document.createElement('p');

p.appendChild(text);

return p.innerHTML;

}

Please note that Veracode Static Analysis will detect this as remediated only because it uses Text nodes. Any custom functions will not automatically be verified and must go through manual verification by your security team through the mitigation process ( https://help.veracode.com/r/improve_mitigation ).

Thank you,

Boy Baukema