Hello @Tun (Community Member)​ ,

Thanks for your question. Veracode Static Analyzer reports a CWE-80 flaw in a JavaScript src html attribute whenever it finds a source of tainted, dynamic input is getting set as part of the value. Essentially any inputs you assign here that are not hardcoded in the JavaScript code will get viewed by the scanner as tainted untrusted input. From reviewing just the code and description you've provided, it seems the source of taint here can correctly be attributed to these dynamic token values that you concatenate and append to the end of the audioURL variable (note the audioURL may also be a source of taint if this is also not hardcoded and is getting read in dynamically from outside the Javascript app, perhaps from an external configuration setting or file).

To fix these kinds of reported CWE-80 findings, you should check that you hardcoded as much of the URL that is getting assigned to this value as you can. Again, this likely can only be done up until we have to add mention of the dynamic token value. Then for the remaining dynamic values in your URL, you can apply positive input validation checks (using a regex for example) to ensure that only valid token formats, patterns and lengths are accepted.

If the whole URL is to be treated/considered as dynamic, then we should have input validation of the entire URL for expected format and values, and that we also only support safe URL protocol values. With this recommendation, what we want to ensure here is that the URL you set here in the src attribute is both a) an expected URL AND b) using HTTPS protocol. What we don't want the code to do here is process unvalidated audioURL + token inputs where the input could come in as either a javascript URL (example: `javascript:alert('Gotcha!')`) OR as a string that attempts to insert an unexpected event handler attribute in your tag that supports executing JavaScript (example: " onload="alert('Gotcha')) . Please be aware this is by no means an exhaustive list of potential XSS javascript: protocol and/or event handler attribute payloads that could impact your application's use case here. This is why we encourage having positive input validation checks for known good URL + token formats over negative validation checks that attempt to look out for and deny risky protocols or tag attributes instead.

After you implement this recommendation, please understand that Veracode Static Analyzer is not able to detect and close out flaws which make use of dynamic input validations, such as regular expressions. You will need to propose a mitigation in order to resolve these particular CWE-80 flaws which can only be reliably fixed using an input validation strategy. For more information on how to do this, please refer to our Help Center: https://docs.veracode.com/r/improve_mitigation . You will want to work with a security minded team member to propose, review, validate and approve your custom input validation mitigation approach here.

I hope this helps. Please let us know if we can offer any further guidance on this issue

Best Regards,

Andrew Bell