JDiaz (Community Member) asked a question.
Is CWE 80 a valid flaw when returning json output in rest APIs?
We have several API endpoints that return data as json. The response has a Content-Type header (application/json) which will prevent to any browser to execute the output as the response will be treated as data not as html, but the static analysis shows there are several flaws as CWE 80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), because contextual escaping wasn't used on the output data.
.png){kind=logo}
Hi @JDiaz (Community Member) ,
Using "application/json" as a Content-Type in the HTTP Response ensures that the browser does not interpret it as HTML and so there is no risk of XSS (at least from direct calling the API, it may still be used as a payload to trigger XSS with JavaScript).
Unfortunately, currently, Veracode Static Analysis is limited in detecting if Content-Type is set, one supported way is the 'produces' attribute for Springs RequestMapping ( https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/bind/annotation/RequestMapping.html#produces-- ).
If you're using a different way to set the Content-Type we recommend documenting this in a mitigation proposal ( https://docs.veracode.com/r/improve_mitigation ) and having this reviewed by a Mitigation Approver in your organization.
Please consider registering your ideas on what to support with Veracode Community Ideas at https://community.veracode.com/s/ideas .
Thank you,
Boy Baukema
@Boy, Security Consultant (Veracode)
Similar question to @JDiaz (Community Member) .Could you please provide some guidance on how to correct CWE ID 80 (found via static scan of python application) with code similar to this:
I have tried sanitized_id = html.escape(id) even though this should not be needed since I'm returning Json from the api and still same issue. Please advice. Thank you!
def get_info(id)
//return array of foos
@app.route("/some-api/foo/<id>", methods=['GET'])
def get_some_stuff(id):
try:
foos = get_info(id)
result = {
"data":{
"foos":{
"someinfo1":{
"results_saved": foos["someinfo1_saved"]
},
"someinfo2":{
"results_saved": foos["someinfo2_saved"]
},
"someinfo3":{
"results_saved": foos["someinfo3_saved"]
},
"someinfo4":{
"results_saved": foos["someinfo4_saved"]
},
"someinfo5":{
"results_saved": foos["someinfo5_saved"]
},
},
},
"metadata":{
"id": id,
"user": getUserInfo(request.headers)
}
}
response = make_response(jsonify(result), 200) # Veracode CWE ID 80
response.headers["Content-Type"] = "application/json" # Set the Content-Type header
return response # Veracode CWE ID 80
except Exception as Argument:
logger.exception(str(Argument))