JRaman655537 (Community Member) asked a question.
CWE 80 in Javascript and in jsp
JQ('#patient_iden_type_id').append(
JQ(document.createElement("option")).attr("value", data.id).text(data.type)
);
I have above code in JSP, Veracode code is complaining CWE 80 in
JQ(document.createElement("option")).attr("value", data.id).text(data.type)
What is solution to fix this CWE 80.
.png){kind=logo}
Hi @JRaman655537 (Community Member),
Veracode Static Analysis reports CWE 80 (XSS) when a value from outside the application is used in a `.attr(element, value)` statement. The reason is that if `value` is potentially user-controlled, and `element` points to a DOM element that accepts JavaScript (such as `onclick`, `onerror`, `src`, etc.), an attacker could abuse this to execute arbitrary JavaScript in a victim's web browser.
In your scenario, you're setting the `value` of an `option` HTML element. Since this kind of element does not accept JavaScript but is an innocuous HTML element, there is no risk of XSS here and I would recommend proposing a mitigation by design and discussing it with your organization's Security Team. For more information on how to propose a mitigation, please refer to: https://docs.veracode.com/r/improve_mitigation.
Thank you,
Florian Walter