ssrinivas930743 (Community Member) asked a question.
Hello Team,
I am getting “CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)” error the following scenarios in asp.net.
1.Assigning HTML string to asp:Literal control.
2.Assiging <a href link to asp:Literal control.
3. if (File.Exists(context.Server.MapPath(fileRes)) && fileRes.EndsWith(".pdf"))
{
using (WebClient User = new WebClient())
{
Byte[] FileBuffer = User.DownloadData(context.Server.MapPath(fileRes));
if (FileBuffer != null)
{
context.Response.ContentType = "application/pdf";
context.Response.AddHeader("X-Content-Type-Options", "nosniff");
context.Response.ContentEncoding = System.Text.Encoding.Unicode;
context.Response.AddHeader("content-length", FileBuffer.Length.ToString());
context.Response.AddHeader("Content-Disposition", string.Format("inline; filename = \"{0}\"", System.IO.Path.GetFileName(file)));
context.Response.BinaryWrite(FileBuffer);
context.Response.Flush();
}
}
}
Please help me
.png){kind=logo}
Hi @ssrinivas930743 (Community Member)
For scenario 1)
You can refer to supported cleansing function to address CWE 80
https://docs.veracode.com/r/Supported_NET_Cleansing_Functions
e.g. antixsslibrary.dll : Microsoft.Security.Application.AntiXss.HtmlEncode()
For scenario 2)
Similar to above, except that you need to use URL contextual escaping
e.g. antixsslibrary.dll : Microsoft.Security.Application.AntiXss.UrlEncode()
For scenario 3)
In general, we are needed to review the how 'FileBuffer' variable is initialized and whether there is a need to contextually escape any untrusted variable used inside of it.
However, I do note that the response type is mentioned as "PDF" and X-Content-Type-Options is also set to "nosniff" which tells me that 'FileBuffer' contains binary for the PDF file.
So here, XSS is not applicable and you can raise 'Mitigation by Design' proposal for the same.
If you still have questions I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif
Hello Kashif,
Thanks for your reply.
I have tired with GetSafeHtml but still i am getting veracode issues
I can't use HtmlEncode fucntion because data converts into html encoding form
example : <div class="col align-self-center"><img src = "../../Resources/Images/test.jpg" alt="Rak Syan image" class="img-fluid candidate-pic" /> </div>
Please help me.
Thanks
Sai