JRaman655537 (Community Member) asked a question.
Hi,
I have following code in my Angular application to show login user photo using MS-Graph API
this.http.get(GRAPH_ENDPOINT + '/photo/$value', { responseType: 'blob' })
.subscribe(photo => {
const url = window.URL || window.webkitURL;
const blobUrl = url.createObjectURL(photo);
this.photo = this.sanitizer.bypassSecurityTrustUrl(blobUrl);
});
Veracode is complaining this.photo = this.sanitizer.bypassSecurityTrustUrl(blobUrl) as CWE 80 error, tried different functions still having issue.
There are few other applications they have same code, but they do not have error. Not sure how veracode detects error in Static scans.
Is there way to fix this error for - this.sanitizer.bypassSecurityTrustUrl(blobUrl)
.png){kind=logo}
Hi @JRaman655537 (Community Member) ,
The reason Veracode Static Analysis reports this as XSS is that data from outside this Frontend application, i.e. variable `photo`, is used to create a blob URL which is then added to the DOM. The concern is that if an attacker could control `photo`, they might be able to create a blob which, upon clicking the generated URL, executes arbitrary JavaScript.
A simple example to demonstrate this would be something like this:
var url = window.URL.createObjectURL(new Blob(["<body><script>alert('xss via href')<\/script></body>"], {type : 'text/html'}));
var a = document.createElement('a');
a.href = url;
a.innerText = 'I\'m totally legit link, click me please!';
document.body.appendChild(a);
The embedded JavaScript, in this case `alert('xss via href')`, may execute when clicking the link.
Mitigating controls here would be:
For more information on how to securely serve a file from a backend, this may also be helpful: https://community.veracode.com/s/question/0D53n00008A802aCAB/fix-cwe-80improper-neutralization-of-scriptrelated-html-tags-in-a-web-page-basic-xssin-binary-data
Please note that Veracode Static Analysis would not automatically close the finding based on these mitigating controls, so you would have to propose a mitigation and discuss it with your Security Team. The following page describes how to do this: https://help.veracode.com/r/improve_mitigation .
Thank you,
Florian Walter
Just wanted to share, this is how I have fixed this issue
OLD code (had issue):
getPhoto() {
this.http.get(GRAPH_ENDPOINT + '/photo/$value', { responseType: 'blob' })
.subscribe(photoObj => {
const url = window.URL || window.webkitURL;
const blobUrl = url.createObjectURL(photoObj);
this.photo = this.sanitizer.bypassSecurityTrustUrl(blobUrl);
});
New code (to fix):
1.In the constructor change DomSanitizer to public sanitizer: DomSanitizer,
2. Declare blobUrl: string;
3. getPhoto() {
this.http.get(GRAPH_ENDPOINT + '/photo/$value', { responseType: 'blob' })
.subscribe(photoObj => {
const url = window.URL || window.webkitURL;
this.blobUrl = url.createObjectURL(photoObj);
});
}
4. In the .html code
[src]="sanitizer.bypassSecurityTrustUrl(blobUrl)"
BTW: Thanks for the stackoverflow posting - https://stackoverflow.com/questions/53222357/angular-6-sanitize-local-drive-url that helped to fix my issue with Veracode scanning.