CCanto141354 (Community Member) asked a question.
Problem with Jquery $.each loop
I'm using a $.each and everytime I use the elements inside the $.each function it is flagged as a flaw, this is how I get the elements that I use, I store inputs from my form in $inputs, this is triggered on submit of the form or onblur of an input.
How can I fix this issue? I don't really understand why looping through my form is flagged as a flaw.
.png){kind=logo}
Hi @CCanto141354 (Community Member),
The reason Veracode Static Analysis flags jQuery's `$(tainted)` as XSS is that older versions of jQuery had a vulnerability where this could actually be exploited. To do this, an attacker would trick jQuery into rendering HTML that can execute JavaScript (such as `<img src=x onerror=...>`).
One resource that describes the issue is https://blog.mindedsecurity.com/2011/07/jquery-is-sink.html. I'm also a fan of this page, http://research.insecurelabs.org/jquery/test/, as it contains a list of known jQuery vulnerabilities and shows you which versions are affected.
I would suggest making sure that your version of jQuery is up-to-date and doesn't have known vulnerabilities. Afterwards, you may want to propose a mitigation and discuss this finding with your organization's Security Team. Please refer to our Help Center (https://docs.veracode.com/r/improve_mitigation) for more information on how to propose mitigations.
Thank you,
Florian Walter