OLdev (Community Member) asked a question.

June 18, 2025 at 6:30 PM
Why is $(element).find() considered XSS vulnerability according to CWE-80?

Hi, I've resolved all but one XSS vulnerability scan found by Veracode, and the last one I have absolutely no idea how to fix at all. The line reads:

 

var $zipCodeEntry = $(element).find('.zip-code-entry');

 

Yeah element is a variable rather than hard coded string, but I've had similar codes scattered elsewhere and they were not flagged for XSS vulnerability. Why this one particulaly triggered Veracode? How do I address this issue properly? Thanks.

  • 3 answers
  • 229 views

  • SamHouston (Veracode)

    Hi @OLdev (Community Member)​ - hope you're doing well!

     

    $() is a jQuery selector function that can lead to XSS depending on the version of jQuery used. If you're on the latest version of jQuery, it's likely not an issue but it still recommended to validate any data passed into the application to potentially risky functions like this. Also, this particular item is likely being flagged because element is seen as tainted and other usage they have elsewhere might not be.

     

    So for this, you can likely put in some validation and propose a mitigation to close out flaw. If you still have questions, Create a Case with the details of the scan or you can schedule a consultation call to review/discuss in more detail.

     

    Here's the vulnerability with jQuery described in a bit more detail: https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-jquery-selector-hash-change-event

     

    Expand Post
    Selected as Best

  • SamHouston (Veracode)

    Hi @OLdev (Community Member)​ - hope you're doing well!

     

    $() is a jQuery selector function that can lead to XSS depending on the version of jQuery used. If you're on the latest version of jQuery, it's likely not an issue but it still recommended to validate any data passed into the application to potentially risky functions like this. Also, this particular item is likely being flagged because element is seen as tainted and other usage they have elsewhere might not be.

     

    So for this, you can likely put in some validation and propose a mitigation to close out flaw. If you still have questions, Create a Case with the details of the scan or you can schedule a consultation call to review/discuss in more detail.

     

    Here's the vulnerability with jQuery described in a bit more detail: https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-jquery-selector-hash-change-event

     

    Expand Post
    Selected as Best

    • OLdev (Community Member)

      @SamHouston (Veracode)​  We are on the latest version of JQuery 3.7.1 so I do not believe it is outdated. What I have so far failed to understand is, why the same scan comes back clean at other places, but only this one is flagged as security vulnerability concern?

       

      Anyway, if I use DOMPurify.sanitize(element), will this resolve the issue? I do not have Veracode Static extension installed on the PC, so I cannot tell locally whether this will work, only after the update has been pushed to github repo.

      Expand Post

      • SamHouston (Veracode)

        Hi @OLdev (Community Member)​ -

         

        Our scanner flags this finding because it can’t determine which jQuery version the application is running. Whether the same issue appears elsewhere depends on which data the scan sees as tainted. If you’d like a deeper review, please open a Support ticket and we’ll take a closer look.

         

        Using DOMPurify may help sanitize the data, but a rescan alone might not clear the finding. In most cases, defining an allow-list of permitted selectors is more effective, though the exact fix will depend on your implementation. If you open a Support ticket, we can help review the scan to see in more detail after you make the changes. It's likely that it will need a mitigation to close out.

        Expand Post

Topics (5)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.