GMoorthy150714 (Community Member) asked a question.
function HideQnPnl(CtrlQn)
{
var Qns = CtrlQn.split('!');
var isHide = Qns[QCnt].split('#');
Hidedivans = "divans" + isHide[0];
$('#' + Hidedivans + ' :input').attr('disabled', false);
}
This is our just simple function.
{
var Qns = CtrlQn.split('!');
var isHide = Qns[QCnt].split('#');
Hidedivans = "divans" + isHide[0];
$('#' + Hidedivans + ' :input').attr('disabled', false);
}
This is our just simple function.
I don't know why here getting XSS CWE ID: 80 flaw was triggered.
What is the solution to reduce the flaw
.png){kind=logo}
Hi @GMoorthy150714 (Community Member) - The issue is that we see Hidedivans as tainted and that variable is used in a jQuery selector $().
For this finding, since you are concatenating static values in the jQuery selector, you shouldn't need to do anything further but we would still highly recommend doing validation if Hidedivans is derived from external input. If you're on the latest version of jQuery they can mitigate the risk accordingly.
Can you tell me fix for the flaw - $('#' + Hidedivans + ' :input').attr('disabled', false);