KKolte003475 (Community Member) asked a question.
how to fix CWE-80 - Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) for image tag.
We are using react to build our application. We have use image tag as below with dynamic source URL. We are getting this veracode issue during static analysis for image tag
https://cwe.mitre.org/data/definitions/80.html
<img
style={imageStyleProperties}
className={iconCssClass}
src={imageSrc}
alt={widgetInputDataProp.widgetProperties["ALT_TEXT"]}
/>
Please let us know how to fix this.
.png){kind=logo}
Hi @KKolte003475 (Community Member),
Whenever a potentially user-controlled URL is being used in the DOM, the first recommendation would be to explore if it is not possible to avoid having the whole URL dynamic. As an example, say that your page embeds YouTube videos. Instead of having the whole video URL dynamic, you could instead hardcode everything but the video ID.
If the whole URL needs to be dynamic, I would recommend applying a regex that makes sure that it actually is a valid URL with only safe protocols being allowed (e.g. HTTPS). In any case you need to make sure that URLs like `javascript:alert('Ha!')` or `data:text/html,<script>alert('Ha!')</script>` (can be embedded like that in iframe src) are not allowed, since they can lead to XSS.
I find Angular's approach for this challenge very reasonable. They seem to be using the following allow-list approach (source: https://github.com/angular/angular/blob/master/packages/core/src/sanitization/url_sanitizer.ts):
const SAFE_URL_PATTERN = /^(?:(?:https?|mailto|ftp|tel|file|sms):|[^&:/?#]*(?:[/?#]|$))/gi;
This explicitly allows a set of URL protocols while implicitly disallowing the rest. If your application simply needs to use HTTPS links, I would recommend applying a simpler regex which just checks if the URL is a) valid and b) using HTTPS.
Please note that Veracode Static Analysis cannot detect dynamic validations, such as regular expressions, and you would have to propose a mitigation. For more information on how to do this, please refer to our Help Center: https://docs.veracode.com/r/improve_mitigation
Thank you,
Florian Walter