pbala857293 (Community Member) asked a question.
Have been facing "Cross-Site Scripting(CWE 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))" flaw category for the below code segments in HTML file .
$.ajax({url: "<local url address >"+param, success: function(result){
var array = result.split(',');
//below 7 lines are actually marked as high risk
$("#date1").html(array[0]);
$("#date2").html(array[1]);
$("#date3").html(array[2]);
$("#date4").html(array[3]);
$("#date5").html(array[4]);
$("#date6").html(array[5]);
$("#date7").html(array[6]);
}});
Any help/ suggestion is appreciated
.png){kind=logo}
Hi @pbala857293 (Community Member),
Veracode Static Analysis reports CWE 80 (XSS) here because data from outside the application (the HTTP response) is being populated into the DOM using `jquery.html`. If an attacker was able to influence what is responded here, they might be able to inject their own HTML and render malicious JavaScript in the web browser of a user of this application. This could e.g. be used to steal cookies or to trigger arbitrary HTTP requests in the name of the victim (CSRF).
To deal with this, we would recommend using `.text()` instead of `.html()`. This leverages some built-in sanitization mechanism and would take care of any risk by preventing HTML from being rendered here for all values in `result`.
Thank you,
Florian Walter