Rp100705 (Community Member) asked a question.
Improper Neutralization of Script-Related HTML
Tags in a Web Page (Basic XSS) in stringbuilder
Tags in a Web Page (Basic XSS) in stringbuilder
Hi Team,
Veracode scan reported the CWE ID 80 issue in the below code. It just escapes the char and adds the quotes.
StringBuilder sbBuilder = new StringBuilder();
sbBuilder.Append("\"");
foreach (char nextChar in strContent)
{
sbBuilder.Append(nextChar);
if (nextChar == '"')
sbBuilder.Append("\"");
}
sbBuilder.Append("\"");
return sbBuilder.ToString(); //veracode reported the issue with CWE ID-80
what was the exact issue in the above code?
.png){kind=logo}
Hi @Rp100705 (Community Member)
CWE 80 is Basic XSS flaws, these are usually supposed to be reported when your application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser in order to steal cookies and or modify the content presented to the user.
We recommend that any untrusted variables used in the construction of the response be contextually encoded. You can use one of the supported cleansing functions given in this link https://help.veracode.com/r/review_cleansers.
If you are sure that that given code is not trying to produce a part of HTTP response of HTML markup or response that might be rendered as HTTP output. You can accordingly raise False Positive proposal on the same. If you require Veracode to confirm this. I would recommend you schedule a consultation call to discuss. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif