Hi @bvaidhyanathan204124 (Community Member)​ ,

Veracode Static Analysis will report use of jQuery.html() ( https://api.jquery.com/html/ ) when we can see that there is potentially untrusted data going into the HTML being injected on the pages. The concern being that an attacker may use this external data to inject their own scripts on your pages.

It's difficult to know what to do without the specifics but in general we see the following scenarios:

1. .html is used where .text can also be used.

If you are just updating a label and only need to set some text, then we strongly recommend you use .text ( https://api.jquery.com/text/ ). For example:

$('a').html("Order " + data.orderId)

Could be turned into:

$('a').text("Order " + data.orderId)

Please note that this will encode any HTML so if you have any static HTML like so:

$('a').html('<i class="eye" />' + data.orderId)

You must only use .text on the dynamic data like `data.orderId`, you could split it up like so:

$('a').html('<i class="eye" /><span id="orderid"></span>');

$('#orderid').text(data.orderId);

Using this will automatically close the flaw.

2. html is being loaded from trusted location (own server)

In older applications you may do something like this:

$.get( "example.com/fileToLoad.html", function( data ) {

$( "html" ).html( data );

});

Please consider using jQuery.load ( https://api.jquery.com/load/ ) instead:

$( "#result" ).load( "example.com/fileToLoad.html" );

This will close the flaw.

If this is not possible, for example because you're taking the result of a POST request you may want to document that in a mitigation proposal: https://docs.veracode.com/r/improve_mitigation . You can learn more about mitigations here: https://community.veracode.com/s/knowledgeitem/mitigations-part-1-what-is-a-mitigation-MCKTIDIWZQ3RBENLRUYP4KSZW3SQ . Please note that someone from your organization will need to manually review the mitigation proposal.

If you have any other questions, I would recommend you schedule a consultation call to discuss.

You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

Thank you,

Boy Baukema

Hi @bvaidhyanathan204124 (Community Member)​ 

Veracode SAST flaggs CWE 80 XSS finding on the Javascript or Jquery code because it seems that untrusted data is being in construction of the HTTP response.

Please review what variable contains and whether it produces HTML mark up content or not.

I would recommend doing HTML escaping on such variables. There is no supported cleansing function to address CWE 80 in Javascript, but I typically recommend something like this (requires jQuery):

function escapeHtml(value) {

 var text = document.createTextNode(value);

 var p = document.createElement('p');

 p.appendChild(text);

 return p.innerHTML;

}

function escapeHtml(value) {

  const p = document.createElement('p'); 

  $(p).text(value); 

  return $(p).html();

}

const escapeHTML = (value) => {

 let t = document.createTextNode(value)

 let p = document.createElement('p')

 p.appendChild(t)

 p.style.visibility = 'hidden'

 return p.innerHTML

}

If you still have questions I would recommend you schedule a consultation call to discuss.

You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.

Regards,

Kashif