pbala857293 (Community Member) asked a question.
CWE 80 (CGI issue , Attack Vector "PRINT" )
Have been facing "Cross-Site Scripting" flaw category for the below code segments in PERL- CGI file .
- print "Invalid parameter", $ENV{'QUERY_STRING'};
- print DBG "param=[$store]\n";
- print "Missing parameter(s): div=$div, dist=$dist.\n";
And so in . All similar Print statements
Any help/ suggestion is appreciated
.png){kind=logo}
Hi @pbala857293 (Community Member),
Veracode Static Analysis reports CWE 80 (XSS) when it can detect that data from outside the application (such as the HTTP request, the database, or the filesystem) flows into functionality that may send that data to a web browser where HTML would be rendered. The concern is that an attacker might be able to inject their own HTML which might allow executing arbitrary JavaScript in the web browsers of your application's users.
I would recommend applying HTML encoding whenever potentially untrusted is rendered in an HTML context, i.e. a web browser. This would remediate any risk and should make the flaws automatically disappear. You can find a list of all our supported cleansing functions here: https://help.veracode.com/r/review_cleansers (you would have to scroll down a bit to section `Supported Perl Cleansing Functions`). An example of a supported cleanser for XSS in Perl would be `escapeHTML()` from the CGI module for HTML markup escaping.
Thank you,
Florian Walter
Also, thinking about it, a `print()` in a Perl CGI script should also be treated differently depending on if it writes the HTTP headers or body of an HTTP response. For a body, the above advice is recommendable. If it's the HTTP response headers, attack vectors like HTTP Response Splitting come to mind which leverage CRLF characters for the attack. To mitigate this attack vector, one would have to strip out the newline characters of dynamic arguments prior to embedding them into the HTTP response headers.