Hello @QNguyen509744 (Community Member)​ ,

Thank you for reaching out to the Community.

Is that your code that our scanner is flagging for an XSS flaw? 

It may be best to open a support case and provide the scan link and flawID to further assist you on this issue.

Best regards,

Steven

Veracode Support Engineer

Hi @QNguyen509744 (Community Member)​ ,

Veracode Static Analysis reports CWE 80 when it can see that data from outside of the application is used written to an HTTP Response.

In the provided code it appears that the application is making an HTTP Request to a downstream API, then directly using that data in it's own HTTP Response. This is sometimes also done with an 'http proxy' that proxies external requests to an internal service.

Frequently, this is done with JSON responses, if this is the case you can help Veracode Static Analysis see that by changing from `res.data` to `res.json`. This should automatically close the flaw as Veracode Static Analysis will now be guaranteed this will always result in a "application/json" Content-Type header in the response.

You can find a similar example on line 17 here: https://runkit.com/relaxnow/63b3fd8eeff984000815131c/branches/master

If however, you are proxying HTML from another service you are tying the security of this application to the security of the other application. This can be dangerous to do if for example, the other service is a third party service that you are not in control of or if the underlying service does not appropriately encode user data in it's HTML.

Options you could consider include:

1. Parsing the HTML from the downstream service and using the data to create your own HTML responses. If properly encoded this should be automatically recognized by Veracode Static Analysis.
2. Applying a sanitizer on the underlying HTML ( for example https://www.npmjs.com/package/sanitize-html ). This is not automatically recognized and requires manual review by proposing a mitigation ( https://docs.veracode.com/r/improve_mitigation ) and requesting a review from your mitigation approver.
3. Trusting the underlying (internal) service (for example by ensuring it is also analyzed by Veracode Static Analysis). This is not automatically recognized and requires manual review by proposing a mitigation ( https://docs.veracode.com/r/improve_mitigation ) and requesting a review from your mitigation approver.

Please let me know if you have any remaining questions or concerns.

Thank you,

Boy Baukema