TScaria621837 (Community Member) asked a question.
Fix - CWE 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
in Binary data
in Binary data
Hi,
In our last scan we got new medium flaws (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE ID 80)) in binary data. Solve this issue by using html sanitizer in string value.
This is one of the sample line of code –
arFileContent = PopulateBytes(attachmentID, Key, auth, out attachmentName);
context.Response.BinaryWrite(arFileContent); //Flow in this line.
Please suggest how to resolve these flaw in binary data?
Thanks,
Jaisa
.png){kind=logo}
Hi @TScaria621837 (Community Member) ,
Veracode Static Analysis reports CWE 80 (XSS) when it can detect that data from outside the application (such as the HTTP request, the database, or the filesystem) flows into functionality that may send that data to a web browser where HTML would be rendered. The concern is that an attacker might be able to inject their own HTML which might allow executing arbitrary JavaScript in the web browsers of your application's users.
In your scenario, you seem to be writing a file, which indicates that it is not meant to be rendered within an HTML, CSS, JavaScript, or XML context. I would recommend setting a content type appropriate for the file to be sent. It is very important to use a safe content type as this is the primary defense wall here to prevent web browsers from potentially trying to render the file contents as e.g. HTML. A list of reasonably safe content types for XSS would be:
Moreover, please set the `Content-Disposition` header to `attachment` (instructs a web browser that this content may not be rendered but should be a file download) and set a `filename`. Also please set the `X-Content-Type-Options` header to `nosniff` to prevent potential issues with MIME Sniffing in older browsers.
Afterwards, please propose a mitigation and discuss it with your Security Team. The following page describes how to do this: https://help.veracode.com/r/improve_mitigation .
Thank you,
Florian Walter