SKamble617706 (Community Member) asked a question.

I am getting this in the analysis report : " 3 - Complex implementation error." for the line 'return variable_name' in a python script. What needs to be fixed?

Description of Veracode Static Scan:

This call contains a cross-site scripting (XSS) flaw. The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser. XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis.

 

Entire python function:

def find_row_number(input_file, sheet_name, target_value):

    """

    Finds the row number in an Excel sheet where the target value is located.

 

    Args:

        input_file (str): Path to the Excel file.

        sheet_name (str): Name of the sheet within the Excel file.

        target_value (str): The value to search for.

 

    Returns:

        int or None: The row number where the target value is found, or None if not found.

    """

    try:

        wb = openpyxl.load_workbook(input_file)

        sheet = wb[sheet_name]

        row_num = None

 

        for row_number, row in enumerate(sheet.iter_rows(), start=1):

            for cell in row:

                if cell.value == target_value:

                    row_num = row_number

                    break  # Exit the inner loop once the value is found

 

        return row_num

 

    except Exception as e:

        print(f"Error occurred: {str(e)}")

        return None

 

---------------------------------------------------------------------

The error is on the line return row_num

 


  • Hi @SKamble617706 (Community Member)​,

     

    Veracode Static Analysis treats data from outside your application code as untrusted. This can be data from user input, a database, network, files on disk, etc. In this case, the `sheet` iterator is returning variables that are marked as containing untrusted data (aka "taint"). The return statement is an "XSS sink" and `row_num` is marked as carrying taint so a flaw is reported.

    We can see that `row_num` is likely a numerical value, which is not something that can contain a XSS payload. You may wish to make this explicit in the code by returning `int(row_num)`. Alternatively, you could enter a mitigation in the Veracode Platform and ask your security team to review.

     

    Kind regards,

    Duncan

    Expand Post

Topics (5)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.