mmadhana146654 (Community Member) asked a question.
CWE ID:80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
looking for possible solutions or suggestions on approach.
looking for possible solutions or suggestions on approach.
Looking for solutions to the below code which is giving CWE ID:80:
setValue('<%=SECConstants.SEC_CONTEXT.CONTEXT_DSC%>','<%=cb.exportNameValue(cb.DT_WEB, SECConstants.SEC_CONTEXT.CONTEXT_DSC)%>',false);
.png){kind=logo}
Hi @mmadhana146654 (Community Member) ,
It looks like this is being reported in a JSP file, is that correct?
In any case, we typically recommend applying one of our supported cleansing functions ( https://docs.veracode.com/r/Supported_Java_Cleansing_Functions ).
For JSP files we typically recommend <c:out> .
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
Veracode Application Security Consulting