Drager (Community Member) asked a question.
How to fix CWE 80 on location.href = response.data;
We have JS which calls an API endpoint and redirects based on the URL returned from the server.
This is being flagged as CWE 80, however it appears like Veracode thinks we are setting a HTML attribute "html" not the window location. Is this just a false positive?
Example:
api.someAjaxCall(data)
.done(function (apiResponse) {
if (apiResponse.status === 'success') {
window.location.href = apiResponse.data;
}
})
.png){kind=logo}
Hi @Drager (Community Member) ,
Veracode Static Analysis reports CWE 80 on use of dynamic (tainted) data going into the `window.location` API. The concern being that if an attacker is able to set the `javascript:` protocol they may be able to execute their own JavaScript on your pages.
In the given code example it appears that an AJAX call is made to an API and this returns something that is likely a URL to be redirected to.
We generally recommend having some validation on input data, especially when it is used in 'dangerous methods' like `window.location`.
For example, the application should only redirect to:
* /login
* /home
In this case you could implement validation like so:
```
if (apiResponse.data === "/home") {
window.location.href = "/home";
} else {
window.location.href = "/login";
}
```
By not using any dynamic data Veracode Static Analysis will be able to detect this flaw as remediated and will automatically close this flaw.
If you require more dynamic redirects you can implement a strict allow-list regex (for example `^/[a-zA-Z0-9/]{1,255}$`).
This will however not be automatically recognized by Veracode Static Analysis and you will need to document this in a mitigation proposal. You can learn more on this here: https://community.veracode.com/s/knowledgeitem/mitigations-part-1-what-is-a-mitigation-MCKTIDIWZQ3RBENLRUYP4KSZW3SQ .
Thank you,
Boy Baukema