SDandekar189851 (Community Member) asked a question.
How to solve CWE ID 201 on Angular html page
Hi,
We are getting CWE ID 201 on the following angular code
<div id="status" style="float:right;">{{status}}</div>
Component.ts has the status variable declared using following syntax.
public status: string = "";
Status parameter gets updated based on the event triggered from child component.
e.g.,
async closeDialog(obj: ICloseObj): Promise<void>{
this.Status = obj.status;
}
Can someone please guide me here?
Regards,
Swati
.png){kind=logo}
Hi @SDandekar189851 (Community Member),
Veracode Static Analysis reports CWE-201 (Insertion of Sensitive Information Into Sent Data) when it detects that potentially sensitive data is sent out of the application. The concern is that the sent information could be confidential (like passwords or personal communications), or it might give adversaries intelligence for later attacks.
In the Veracode Platform, within the Triage Flaws view, the flaw description will offer more information on why the Static Analysis engine identified the content of this variable as potentially sensitive. To see a specific flaw's description, click on the black triangle located at the far left in the Triage Flaws view.
To address this finding, we recommend reviewing whether the transfer of sensitive data is intentional and compliant with your application security policy. If it is unintentional or breaches your application security policy, stop transmitting that specific data. Otherwise, we recommend proposing a mitigation and consulting with your security team. For guidance on proposing mitigations, please refer to this documentation.
Kind regards,
Duncan